지갑 및 컨트랙트 온체인 활동 모니터링 및 요약 에이전트

This skill contains a full TypeScript implementation but the registry claims 'instruction-only' and lists no required credentials—that mismatch is the main red flag. Before installing or running it: 1) Expect to run `npm install` / build; do this in an isolated environment (container) rather than on a production host. 2) Review or provide only scoped API keys: ETHERSCAN_API_KEY (required for real data) and a single LLM key (GROQ_API_KEY or ANTHROPIC_API_KEY or GOOGLE_API_KEY). Avoid reusing high-privilege keys. 3) Note the code loads a .env file from the package; ensure it won't accidentally read sensitive host-level .env files. 4) Be aware transaction data and addresses will be sent to third-party LLM endpoints—if privacy is a concern, don't provide sensitive addresses or run with mock mode (omit ETHERSCAN_API_KEY). 5) Ask the publisher for corrected metadata (declare required env vars and an install spec) or request a packaged release from a known homepage/source before trusting the skill. If you want, I can list the exact lines that read env vars and call external APIs to help you audit them.

Type: OpenClaw Skill Name: agent-onchain-watch Version: 1.0.1 The OnchainWatch Agent is a legitimate tool designed to monitor Ethereum wallet activity and generate summaries using LLMs. The code in 'src/fetcher.ts' and 'src/analyzer.ts' correctly implements data retrieval from Etherscan and applies basic risk-detection logic (e.g., flagging high-value transactions). The LLM integration in 'src/llm/' uses standard SDKs and REST APIs for Groq, Anthropic, and Gemini without any signs of prompt injection, data exfiltration, or unauthorized command execution. The inclusion of a mock agent in 'src/index.ts' is for development testing and contains no harmful behavior.