Morpho Earn - earn safe yield on your USDC on Base

Earn yield on USDC by supplying to the Moonwell Flagship USDC vault on Morpho (Base). Use when depositing USDC, withdrawing from the vault, checking position/APY, or setting up wallet credentials for DeFi yield.

This skill appears to implement the described Morpho/Moonwell automation, but it operates on real funds and relies on external services to construct and sign transactions. Before installing: - Review the code (especially scripts/config.ts, simulateAndWrite/verifyContracts, and the Odos assemble usage) to ensure they do exactly what you expect. - Use a dedicated hot wallet with only a small amount of USDC/ETH for testing — never your main wallet. - Test read-only commands first (status.ts, report.ts) before running any claim/compound operations. - If you plan to use 1Password integration, ensure the 'op' CLI is available (the skill doesn’t declare it). - Understand that the Odos assemble/quote endpoints return transaction payloads your wallet will sign — if Odos or the network between you and Odos is compromised it could return malicious tx data. Consider replacing or verifying aggregator responses locally where possible. - Verify the RPC endpoints (default is moonwell's RPC) and prefer your own trusted RPC provider. - If you want lower risk, disable autoCompound and require manual approval for claim/swap/deposit actions. If you want, I can: (1) point to the exact lines/functions to audit (simulateAndWrite, assembleOdosTransaction, verifyContracts), (2) summarize where private keys are read and stored, or (3) produce a short checklist to harden usage (file perms, environment variables, manual approval).

Type: OpenClaw Skill Name: morpho-earn Version: 1.2.0 The skill is designed for managing DeFi yield on the Morpho protocol. It handles private keys securely (supporting file, environment variable, and 1Password with `op read`), performs on-chain transactions (deposit, withdraw, compound, claim rewards), and interacts with legitimate DeFi APIs (Merkl, Odos, Morpho API, Coingecko). Key security features include transaction simulation, contract address verification, input sanitization in `setup.ts`, and local transaction logging. Markdown files (`SKILL.md`, `CLAUDE.md`, `README.md`) provide clear instructions for the AI agent and users, without any evidence of prompt injection attempts to deviate from the stated purpose or exfiltrate sensitive data. All network and file system access is directly related to the skill's functionality.