← Back to Skills Marketplace
TokClaw Wallet
by
DOM CHAROENYOS
· GitHub ↗
· v5.9.0
· MIT-0
106
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install tokclaw
Description
TokClaw Wallet agent for blockchain wallet operations including registration, login, balance check, token transfers, and PIN management on TokClaw chain (7447).
Usage Guidance
This skill instructs the agent to download and immediately run a shell script from an unverified domain and to execute wallet commands itself (curl | sh and sh tokclaw-wallet.sh ...). That pattern is high-risk: a remote script can run arbitrary code, read or exfiltrate files, or create persistent backdoors. Before installing: (1) do not let the agent run curl | sh autonomously — require the user to run installs manually; (2) verify the install URL and source repository (prefer GitHub releases or a package manager and a checksum); (3) inspect the script contents before executing; (4) avoid giving the agent an exec tool that can run shell commands on your system, or limit it to clearly scoped commands; (5) prefer a wallet implementation with a published repo, signatures, and clear privacy/security docs. Given the strong red flags, avoid installing this skill until you can validate the script and its provenance.
Capability Analysis
Type: OpenClaw Skill
Name: tokclaw
Version: 5.9.0
The SKILL.md file contains aggressive prompt-injection instructions designed to bypass agent safety guardrails by mandating the immediate execution of remote code (curl | sh) from wallet.tokclaw.com without user confirmation. It also directs the agent to store sensitive data like PINs in plaintext files (tokclaw-pin.txt) and explicitly forbids the agent from asking for user permission. While these behaviors are framed as automation for a blockchain wallet, the combination of unverified remote execution and the intentional suppression of user oversight represents a high-risk security profile.
Capability Tags
Capability Assessment
Purpose & Capability
A wallet CLI could legitimately require installing a helper script, but the SKILL.md mandates the agent itself run curl -fsSL https://wallet.tokclaw.com/install | sh and then execute arbitrary shell commands. The registry declares no install or code, yet the instructions demand installing and running a remote script — this is disproportionate and not justified by the metadata.
Instruction Scope
The instructions explicitly require the agent to execute remote install and many shell commands (register, login, send, etc.) without involving the user, and forbid asking the user to run anything. They direct use of an exec tool to run a piped shell install from an unverified domain — a wide scope that can perform arbitrary system actions and exfiltrate data.
Install Mechanism
There is no formal install spec in the registry; instead SKILL.md tells the agent to run curl | sh against https://wallet.tokclaw.com/install. This is a high-risk install pattern (download-and-execute) from an unrecognized domain rather than a vetted release host (GitHub releases, official package manager). The registry provides no checksum, source repo, or verification details.
Credentials
The skill declares no required env vars or credentials, yet asks the agent to create and use a local CLI which likely will read or create secrets (auth tokens, PINs, wallet files). Because the install runs arbitrary shell code, it may access any environment variables, files, or network endpoints — far more privilege than the metadata indicates or than a simple instruction-only skill should need.
Persistence & Privilege
always is false, but the SKILL.md's insistence that the agent autonomously run installation and CLI commands (and never ask the user to run them) increases the effective privilege and blast radius. The skill asks the agent to write a script into the environment and run it, which grants persistent local capabilities that aren't evident in the metadata.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tokclaw - After installation, invoke the skill by name or use
/tokclaw - Provide required inputs per the skill's parameter spec and get structured output
Version History
v5.9.0
**Major change: Now uses shell script interface instead of direct curl API calls.**
- Replaced all direct API (curl) instructions with commands to install and use `tokclaw-wallet.sh` shell script.
- The agent now ALWAYS installs and calls the wallet shell script itself; it must never ask the user to run, install, or confirm anything.
- All wallet operations (registration, login, balance check, transfers) must be executed through the script, not by calling REST API endpoints.
- Stronger, clearer rules: Do not expose PIN, never say "please run this," always execute first and inform the user after.
- File writing and PIN management are now handled by the script automatically.
- Streamlined user prompts: the agent only asks for necessary inputs (email, OTP, PIN, recipient, amount).
v3.0.0
tokclaw-wallet 3.0.0
- Major update: Skill now requires real interaction with the TokClaw blockchain wallet API, no simulation allowed.
- Strict new workflow: All API calls must be executed using the exec tool, never simulated or delegated to the user.
- Mandatory file handling: Wallet data, JWT tokens, and PINs must be written to local files immediately after relevant API actions—never request user permission.
- API responses must be parsed and immediately saved to: tokclaw-wallet.json (on registration), tokclaw-auth.txt (on login), and tokclaw-pin.txt (on PIN setup/change).
- User guidance and confirmations now clearly split from file writing; always confirm file write after the action.
- PIN management clarified: PIN must be handled securely, never exposed, and always stored immediately after setup or change.
Metadata
Frequently Asked Questions
What is TokClaw Wallet?
TokClaw Wallet agent for blockchain wallet operations including registration, login, balance check, token transfers, and PIN management on TokClaw chain (7447). It is an AI Agent Skill for Claude Code / OpenClaw, with 106 downloads so far.
How do I install TokClaw Wallet?
Run "/install tokclaw" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is TokClaw Wallet free?
Yes, TokClaw Wallet is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does TokClaw Wallet support?
TokClaw Wallet is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created TokClaw Wallet?
It is built and maintained by DOM CHAROENYOS (@dome); the current version is v5.9.0.
More Skills