← Back to Skills Marketplace
Polygon Agents SDK
by
JamesLawton
· GitHub ↗
· v1.0.0
439
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install polygon-agents-sdk
Description
Complete Polygon agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity...
Usage Guidance
This skill appears to implement what it claims, but it performs sensitive operations (generates/saves private keys, auto-downloads/executes cloudflared, exposes a public tunnel and temporary blobs). Before installing or running it: 1) Verify the upstream repo (https://github.com/0xPolygon/polygon-agent-kit) is authentic and review its code — especially any cloudflared download logic and where binaries are fetched from. 2) Prefer installing and running in an isolated environment (VM/container) rather than a primary machine. 3) Do not paste or share private keys or session blobs publicly; treat SEQUENCE_* keys as secrets. 4) If you must use it on a workstation, verify any downloaded binary checksums/signatures and consider using your own Cloudflare/connector setup instead of auto-tunnel. 5) If you lack comfort auditing the code, ask for a signed release or a package from a verifiable publisher before proceeding.
Capability Analysis
Type: OpenClaw Skill
Name: polygon-agents-sdk
Version: 1.0.0
The skill bundle is classified as suspicious due to its instruction to automatically download and execute the `cloudflared` binary and establish a Cloudflare Quick Tunnel (`*.trycloudflare.com`) to expose a local HTTP server to the internet. While this mechanism is described as necessary for wallet session approval callbacks, the automatic execution of a third-party binary and creation of a public-facing tunnel without explicit user confirmation beyond the initial `npm install` introduces significant supply chain and network exposure risks, even if the stated intent is functional. This capability, detailed in SKILL.md and QUICKSTART.md, represents a high-risk behavior that could be exploited if the `cloudflared` binary or the local server were compromised.
Capability Assessment
Purpose & Capability
Name, description, and the CLI commands in SKILL.md consistently describe a Polygon agent toolkit (wallet/session creation, token ops, ERC‑8004 registration). The declared environment variables in the docs (SEQUENCE_PROJECT_ACCESS_KEY, SEQUENCE_INDEXER_ACCESS_KEY, optional Trails keys) are appropriate for the described functionality.
Instruction Scope
The instructions require running a third‑party CLI (npm install -g github:0xPolygon/polygon-agent-kit) that will: create and store private keys, auto-open a Cloudflare Quick Tunnel, save session blobs to /tmp, and insist you transmit full approval URLs to users. Those actions are expected for a session-based wallet flow, but they broaden the agent's runtime surface (network-exposed tunnels, temporary plaintext blobs, local storage of private keys) and could enable attack vectors if the underlying code or downloaded binaries are malicious or tampered with.
Install Mechanism
SKILL.md instructs installation from a GitHub repo via npm (github:0xPolygon/polygon-agent-kit) — a common pattern but still fetches code at install time. More concerning: the CLI auto-downloads a cloudflared binary into ~/.polygon-agent/bin/ on first use. Auto-downloading and executing binaries from the network increases risk unless the source and integrity checks (signatures/checksums) are explicit. The registry metadata itself had no install spec or homepage listed, which reduces traceability.
Credentials
Required environment variables listed in SKILL.md (SEQUENCE_PROJECT_ACCESS_KEY and SEQUENCE_INDEXER_ACCESS_KEY) are directly relevant to wallet/session operations. Optional vars (TRAILS_API_KEY, TRAILS_TOKEN_MAP_JSON, debug flags) also make sense. The skill will output and ask you to save private keys and stores encrypted material in ~/.polygon-agent/ — expected, but these are high‑sensitivity secrets and the workflow involves temporary plaintext blobs in /tmp and URLs that must be copied exactly.
Persistence & Privilege
The skill is instruction-only and does not request always:true or other elevated platform privileges. However, the CLI behavior described will create persistent files under ~/.polygon-agent/ (encrypted storage and a bin folder for cloudflared) and write temporary files under /tmp; it also spawns a network tunnel. Those are normal for a CLI wallet but constitute persistent disk and network state that you should be willing to host on the machine used.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install polygon-agents-sdk - After installation, invoke the skill by name or use
/polygon-agents-sdk - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial public release of polygon-agent-kit — an all-in-one toolkit for building Polygon smart agent experiences.
- Provides a session-based CLI for creating and managing smart contract wallets, sending, bridging and use tokens for any onchain action, onchain identity registration and reputation with 8004, and x402 micropayments.
- Encrypted local storage for wallet/session data with built-in smart sessions to control daily limits, thresholds, and contract calls to execute onchain transactions safely for your agent.
- Requires minimal env setup; operates via dry-run by default, with explicit broadcast mode for writes.
- Built-in interactive wallet creation/approval flow using Cloudflare Quick Tunnel for secure session handshakes.
- Supports troubleshooting, debug logging, flexible session controls, and robust funding/approval safeguards.
- Comprehensive built-in CLI reference and practical setup guides included for common flows
Metadata
Frequently Asked Questions
What is Polygon Agents SDK?
Complete Polygon agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity... It is an AI Agent Skill for Claude Code / OpenClaw, with 439 downloads so far.
How do I install Polygon Agents SDK?
Run "/install polygon-agents-sdk" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Polygon Agents SDK free?
Yes, Polygon Agents SDK is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Polygon Agents SDK support?
Polygon Agents SDK is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Polygon Agents SDK?
It is built and maintained by JamesLawton (@jameslawton); the current version is v1.0.0.
More Skills