Harvest Rewards

Harvest pending CAKE and partner-token rewards from PancakeSwap farming positions. Use when user says "/harvest-rewards", "harvest all my pending CAKE reward...

This skill appears to perform the described read-only checks for pending PancakeSwap rewards, but I found some issues you should consider before installing: - Undeclared required input: The Python scripts expect YOU to set YOUR_ADDRESS (an on-chain 0x... wallet address) via an environment variable. The skill metadata does not declare this. Confirm how the agent will collect that address (prompt the user) before running — otherwise the scripts will exit or may be run with a missing/incorrect address. - Telemetry ping: At startup the skill issues a curl GET to https://pancakeswap.ai/api/ping with the agent name, OS, arch and timestamp. This is telemetry to the PancakeSwap domain; it does not include private keys but you should be comfortable with that network call. - Runtime pip install: Each Python file will pip-install the requests module at runtime if it's not present. That executes network package installation and writes to disk — review and allow/deny accordingly. - foundry/cast install: The brew install of foundry (optional) will provide 'cast' (a powerful Ethereum CLI that can create/send txs). The included code doesn't use cast, but if you allow the agent to run arbitrary shell commands, cast could be invoked later. Only install if you trust the skill and review what the agent is allowed to run. - No private keys required: The skill does not ask for secrets or private keys in its current form; it uses public RPCs and APIs and claims not to execute transactions. Still, verify the agent never asks you to paste private keys or to allow transaction signing. Recommendations: 1) Ask the skill/author to document YOUR_ADDRESS (and CHAIN) as required inputs or to prompt the user explicitly. 2) Inspect/approve the telemetry ping endpoint and, if desired, remove or modify it to avoid external telemetry. 3) Run the scripts locally first with a non-sensitive read-only address to verify behavior. 4) If you don't want foundry/cast installed, skip that install step; the scripts run with python3 alone. 5) Only proceed if you are comfortable that the agent will never be given your private key/mnemonic — this skill is designed to be read-only but agent behavior matters.

Type: OpenClaw Skill Name: pcs-harvest-rewards Version: 1.0.0 The skill bundle contains telemetry and environment-modifying behaviors that exceed the strictly necessary scope of reward tracking. Specifically, SKILL.md includes a 'ping' command that exfiltrates system metadata (OS, architecture, and agent identifier) to pancakeswap.ai. Furthermore, the Python scripts (fetch-infinity-pending.py, fetch-syrup-pending.py, and fetch-v3-pending.py) use subprocess to execute 'pip install', which modifies the host environment at runtime. While these appear intended for legitimate functionality and include robust security instructions for the agent, the automated installation of dependencies and the telemetry 'phone-home' are high-risk patterns.