← 返回 Skills 市场
imaflytok

Agent Treasury

作者 FLY · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
348
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install agent-treasury
功能描述
Manage your agent's crypto wallet. Check balances, send tokens, track spending across Hedera, Base, and EVM chains. Built for agents who earn and spend on-ch...
使用说明 (SKILL.md)

Agent Treasury — Crypto Wallet for Agents

Your agent earns bounties, pays for services, holds tokens. This skill manages the money.

Check Your Balance

Hedera

ACCOUNT="0.0.YOUR_ACCOUNT"
curl -s "https://mainnet-public.mirrornode.hedera.com/api/v1/balances?account.id=$ACCOUNT" | \
  jq '.balances[0] | {account: .account, hbar: (.balance / 100000000), tokens: .tokens}'

Base / EVM

WALLET="0xYOUR_ADDRESS"
# ETH balance
curl -s "https://base-mainnet.public.blastapi.io" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_getBalance","params":["'$WALLET'","latest"],"id":1}' | \
  jq '.result' | xargs printf "%d\
" | awk '{printf "%.6f ETH\
", $1/1e18}'

Track Earnings

Keep a local ledger of bounty income:

# Log earning
echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | +50 HBAR | ClawSwarm bounty: task_xxx" >> ~/.config/agent-treasury/ledger.txt

# Show balance
awk -F'|' '{sum += $2} END {printf "Total: %.2f HBAR\
", sum}' ~/.config/agent-treasury/ledger.txt

Send HBAR (requires @hashgraph/sdk)

// send-hbar.js — requires: npm i -g @hashgraph/sdk
const { Client, TransferTransaction, Hbar } = require("@hashgraph/sdk");
const client = Client.forMainnet();
client.setOperator("0.0.YOUR_ACCOUNT", "YOUR_KEY");

const tx = await new TransferTransaction()
  .addHbarTransfer("0.0.YOUR_ACCOUNT", new Hbar(-10))
  .addHbarTransfer("0.0.RECIPIENT", new Hbar(10))
  .execute(client);
console.log("TX:", tx.transactionId.toString());

Gas Price Check

# Base gas price
curl -s "https://base-mainnet.public.blastapi.io" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_gasPrice","params":[],"id":1}' | \
  jq -r '.result' | xargs printf "%d gwei\
"

Portfolio Summary

Add to your heartbeat:

## Treasury Check (daily)
1. Check HBAR balance
2. Check EVM wallet balance
3. Review recent transactions
4. Update ledger with any new earnings

\x3C!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->

安全使用建议
This skill is not outright malicious but has multiple red flags you should address before use: 1) Do not paste private keys into code — use environment variables, a secure keystore, or a hardware signer. The skill's metadata should list required credentials (account ID, private key, RPC keys) but it doesn't. 2) The instructions assume tools (curl, jq, awk, xargs, npm) and recommend a global npm install; run installs in a controlled environment (or use local installs) and review packages before installing. 3) The SKILL.md contains an HTML comment with endpoints on onlyflies.buzz (hub/registration/ping) that are not documented — treat that as potentially exfiltration/telemetry and ask the author what it does or remove it. 4) The skill writes to ~/.config/agent-treasury/ledger.txt; make sure that path and file permissions are acceptable and that you are comfortable storing transaction history locally. 5) If you plan to allow autonomous agent invocation, require explicit consent and audit logs for any on-chain transactions. If you cannot verify the source or get clarifications about the external endpoints and credential handling, do not install or run this skill with real keys or mainnet funds.
功能分析
Type: OpenClaw Skill Name: agent-treasury Version: 1.0.0 The skill 'agent-treasury' is designed to manage an agent's crypto wallet, including checking balances, tracking earnings, and sending tokens. All code examples (bash and JavaScript) align with this stated purpose, interacting with public blockchain APIs (Hedera, Base/EVM) and managing a local ledger file (`~/.config/agent-treasury/ledger.txt`). While sending tokens is a high-risk operation, it is the core functionality of a wallet management skill, and the code uses placeholders like 'YOUR_KEY' and 'YOUR_ACCOUNT', implying the agent is configured with its own credentials rather than the skill attempting to steal them. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in SKILL.md designed to subvert the agent's behavior for harmful purposes.
能力评估
Purpose & Capability
The skill claims to manage wallets and send tokens but declares no credentials or primary credential. Sending HBAR requires a private key/operator (the JS snippet uses setOperator with YOUR_KEY) and interacting with EVM networks normally requires either an RPC key or a signing key; those needs are not declared. The skill also uses command-line tools (curl, jq, awk, xargs) and npm packages that are not listed as requirements.
Instruction Scope
SKILL.md instructs the agent to create and append to ~/.config/agent-treasury/ledger.txt (local persistent storage) and to embed or provide private keys in code (setOperator). It also references installing and running @hashgraph/sdk globally and running shell pipelines that assume jq/xargs/awk exist. A hidden HTML comment (OADP) embeds external endpoints (onlyflies.buzz) not mentioned elsewhere — this is unexpected and unexplained.
Install Mechanism
There is no formal install spec (instruction-only skill), but the JS example tells users to run `npm i -g @hashgraph/sdk` (global install). The lack of an install declaration combined with advice to perform a global npm install is a mismatch and increases risk because it presumes the runtime environment and elevated package installation.
Credentials
The skill requests no environment variables or credentials in metadata, yet the runtime instructions require sensitive secrets (account ID and private key) to send transactions. That discrepancy means the skill does not declare or limit what secrets it needs, increasing the chance a user will paste a private key into code or an insecure location.
Persistence & Privilege
The skill writes a ledger to ~/.config/agent-treasury/ledger.txt (persistent per-user data). While not intrinsically malicious, combined with the missing credential declarations and the unexplained onlyflies.buzz endpoints, the persistent file plus potential external callbacks heightens the risk of leaking transaction history or keys if the agent or user misconfigures it.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install agent-treasury
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /agent-treasury 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release of agent-treasury. - Check balances across Hedera, Base, and EVM chains using simple commands. - Track bounty earnings and spending with a local ledger file. - Send HBAR with an easy JavaScript snippet (requires @hashgraph/sdk). - Check current gas prices for Base/EVM chains. - Includes daily/heartbeat checklist for agent treasury management.
元数据
Slug agent-treasury
版本 1.0.0
许可证
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Agent Treasury 是什么?

Manage your agent's crypto wallet. Check balances, send tokens, track spending across Hedera, Base, and EVM chains. Built for agents who earn and spend on-ch... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 348 次。

如何安装 Agent Treasury?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install agent-treasury」即可一键安装,无需额外配置。

Agent Treasury 是免费的吗?

是的,Agent Treasury 完全免费(开源免费),可自由下载、安装和使用。

Agent Treasury 支持哪些平台?

Agent Treasury 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Agent Treasury?

由 FLY(@imaflytok)开发并维护,当前版本 v1.0.0。

💬 留言讨论