Polygon PoS Development

Comprehensive guide for Polygon PoS blockchain development. Use when deploying smart contracts to Polygon, testing on Amoy testnet, getting test tokens from faucets, or verifying contracts on Polygonscan. Supports Foundry framework with deployment scripts and testing strategies.

What to consider before installing/using this skill: - Inconsistency: the registry claims no required env vars, but the guide expects PRIVATE_KEY, POLYGONSCAN_API_KEY, WALLET_ADDRESS, and RPC URLs. Treat that mismatch as a red flag and confirm expected secrets before proceeding. - Private key risk: following the guide requires supplying a private key which can sign and broadcast real transactions. Never provide your mainnet private key in plaintext to an agent or service. Prefer one of: an ephemeral testnet account, a key with limited funds, a hardware wallet, or a remote signing service (e.g., MetaMask, Gnosis Safe, or a signing API) that keeps the key off the machine/agent. - Minimize scope: for automation, give the smallest-privilege key possible (testnet-only key, low funds). Avoid embedding long-lived mainnet keys in .env files. Keep .env files out of version control and use secure secret storage where possible. - Review commands before running: the skill recommends running remote installers (curl | bash) and docker/pip installs. Verify those URLs are official and inspect scripts when possible. - Autonomous invocation caution: the skill can cause state changes (deploy/transfer) if the agent is allowed to run it with a PRIVATE_KEY. If you enable autonomous invocation, restrict the skill’s access to secrets or disable autonomous execution when sensitive operations are involved. - Trust & provenance: the skill's source/homepage are unknown. Prefer official/maintained guides or double-check commands against Foundry and Polygon documentation before executing. If you still want to use this skill: test with an ephemeral/testnet-only key first, do not use a funded mainnet key, and require manual approval before any transaction broadcast.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is classified as suspicious primarily due to the use of `curl -L https://foundry.paradigm.xyz | bash` for installing Foundry, as seen in `SKILL.md`, `references/foundry-deployment.md`, and `references/testing-strategies.md`. While this is a common installation method for Foundry from its official source, the `curl | bash` pattern is an inherently high-risk execution method that downloads and executes a remote script, which could be exploited if the source were compromised. Additionally, the skill instructs the agent/user to handle sensitive information like private keys and API keys, although it does provide explicit advice to store them in `.env` files and add them to `.gitignore`.