← 返回 Skills 市场
tezatezaz

Clawcast - Cast Ethereum Wallet for Agents

作者 te_za · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
1358
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install clawcast-wallet
功能描述
Skill for managing EVM wallets, transactions, and network helpers via cast; covers onboarding, checks, and operating procedures.
使用说明 (SKILL.md)

Cast Skill

Agent note: When this skill is installed or first discovered, make sure to record a TOOLS.md entry summarizing it so the workspace cheat sheet stays up to date.

This skill is focused on crypto/EVM wallet operations and transaction workflows using cast. It covers wallet creation, import, network selection, token awareness, and general transaction helpers so the agent can guide the user through everyday crypto tasks.

Resources

  • EVM network listassets/evm-networks.json contains the RPC endpoints, chain IDs, and reference links for the major Ethereum-compatible networks. Use it as the authoritative source when building RPC helpers, validators, or network selectors for Cast workflows.
  • Token metadataassets/evm-network-tokens.json tracks native/wrapped/stable tokens per network, explorers, and helpful notes about bridged assets. Load the relevant entry when Cast needs to recommend contracts, validate tokens, or produce explorer URLs.

Scripts

  • Step scriptsscripts/01_install_cast.sh..06_finish.sh cover the onboarding flow described in the README: install Foundry/cast, create or import a key, encrypt the keystore, choose network/RPC/tokens (sourced from the JSON assets), and show the resulting address and balance. Run them in order when the user requests onboarding. Each script already prompts for the necessary inputs (mnemonic/private key, password, RPC URL, token details), so relaying the same questions to the user and then running the next script is the recommended approach.
  • Wallet health checkscripts/check_wallet.sh inspects the shared state and reports whether a keystore/address pair already exists; it returns success (0) when a wallet is present and 1 otherwise.
  • Network statusscripts/show_network.sh prints the active network name, chainId, and RPC URL from ~/.agent-wallet/state.env, or warns if the configuration is incomplete.
  • Wallet removalscripts/remove_wallet.sh safely deletes the keystore, password stash, and metadata from ~/.agent-wallet/state.env after an explicit confirmation.

Agent guidance

Before the onboarding scripts run, let the user know that each step will be handled in a tight loop: ask one focused question, execute the corresponding script, confirm the outcome, and then move on. Avoid dumping a long plan all at once so the flow feels like a series of small, interactive steps rather than a single heavy procedure. When speaking with the user, keep the language simple—don’t overwhelm them with filenames or the internals of the scripts unless specifically asked. Frame it as a conversation about what you need to know next rather than as a technical checklist.

Always ask the user, right before running each script, exactly the question that script itself will ask (password, network choice, etc.). Do not invent or fill in answers on their behalf—only use the information they explicitly provide. This keeps onboarding faithful to what they chose and avoids pushing the scripts forward with made-up data.

  1. Start with targeted help if stuck. Pipe cast --help through grep (e.g., cast --help | grep balance) to zero in on the relevant subcommand and avoid scrolling the entire manual; this saves tokens and keeps the answer focused before you proceed or explain anything.
  2. Automatic readiness check. Run scripts/check_wallet.sh automatically each session; do not ask the user to trigger it. If it detects an existing wallet, immediately display the saved address/keystore path and proceed to show the balance/network status (see next step) so the user sees “wallet ready” without extra probes.
  3. Show wallet + network status. When check_wallet finds a wallet, run scripts/show_network.sh and query the balance (e.g., cast balance \x3CADDRESS> --rpc-url \x3CRPC_URL> --ether) so the user sees the current native balance, network name, chainId, and RPC URL without being prompted to check anything manually.
  4. Onboarding flow (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3:
    1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned cast command works before proceeding.
    2. Key material — before running the wallet step, ask whether they want to create a new hot keypair, import a 12/24-word MetaMask-compatible mnemonic (m/44'/60'/0'/0/0), or import a private key. Collect the chosen secret, confirm the resulting address right after the step finishes, and tell the user that address before moving on. When generating a new keypair, capture the mnemonic displayed by cast wallet new, save it to ~/.agent-wallet/mnemonic-words-\x3Ctimestamp>.txt, and tell the user the exact path plus the fact that a job (via at now + 1 hour if available or a background sleep fallback) will delete that file after 60 minutes so the seed phrase does not linger.
    3. Password — only ask for the keystore password once (there is no confirmation prompt, no save/remember question, and the account name is forced to “agent”). The script saves that password to the local helper file and uses it when creating the keystore, so nothing else is needed from the user for this step.
    4. Network — read aloud the default network list derived from assets/evm-networks.json, ask which numbered network they want, and note that the script now auto-selects the first RPC URL from that entry (it saves the matching CHAIN_ID/ETH_RPC_URL and then just shows the RPC so the user can see which endpoint is being used).
    5. Tokens — the script now prints the token table derived from assets/evm-network-tokens.json so it appears directly in chat, asks whether you want to add a token for the selected network, and when you agree it records each symbol/address/decimals pair straight into that network’s JSON entry (no intermediate tokens.tsv file is involved).
    6. Finish — after the scripts confirm success, summarize the wallet (address, network name, RPC URL) and run the balance lookup so the user leaves onboarding with full clarity and sample cast commands.
  5. Teardown: if the user wants to remove the wallet, run scripts/remove_wallet.sh; it asks for confirmation, deletes the keystore/password files, clears the state entries, and reports what was removed.

Transaction logging

Whenever you mention a transaction (history, hash, or significant transfer) to the user, append a short summary to logs/tx_mentions.log in the workspace. Include the UTC timestamp, wallet address, tx hash (if available), and a one-line description of why the transaction was mentioned. This keeps a running record for later reference.

If you can’t automatically fetch data from a network explorer because an API key is required (e.g., BscScan/Etherscan V2), tell the user that we need to fall back to manual viewing and share the direct Explorer URL (e.g., https://bscscan.com/address/\x3Caddress> or https://bscscan.com/tx/\x3CtxHash>) so they can open it themselves. Mention the limitation plainly instead of leaving them waiting for data we can’t pull.

Operator reference (common cast commands)

  1. cast balance \x3Caddress> — check the native coin balance (ETH, etc.). Common flags: --rpc-url ..., --ether for human-readable formatting, --block to target a specific block/tag.
  2. cast send — the workhorse for native transfers, ERC-20 transfers/approvals, swaps, or any signed contract interaction. Typical flags: --rpc-url ..., --keystore ..., --password-file ..., --value ..., --data or function signature/args, optional gas controls (--gas-limit, --gas-price, --priority-gas-price, --nonce, --legacy).
  3. cast call — perform read-only contract calls (balanceOf, allowance, decimals, totalSupply, etc.). Common flags: --rpc-url ..., --block ..., or --data ... when you already have calldata.
  4. cast receipt \x3CtxHash> — fetch and inspect the transaction receipt (status, gas, logs); use it to confirm success after cast send. Optional flags: --confirmations ... or requesting a single field by name.
  5. cast tx \x3CtxHash> — fetch a transaction’s details; you can request a specific field or raw RLP with --raw.
  6. cast nonce \x3Caddress> — get the current nonce to avoid "nonce too low" errors, especially when batching; optionally target a block/tag.
  7. cast rpc \x3Cmethod> [params...] — make raw JSON-RPC calls for edge cases, debug methods, or custom node features. Use --raw when passing a JSON array by string or via stdin.
  8. cast mktx ... — build and sign a raw transaction without broadcasting (prep for "prepare → review → publish"); same to/signature/args or --data, plus knobs like --value, --nonce, --gas-limit, --gas-price, --priority-gas-price.
  9. cast publish \x3CrawTx> — broadcast a signed raw transaction (pairs with mktx or any external signing flow); --async is optionally useful.
  10. cast wallet new / cast wallet new-mnemonic — generate keys or a BIP-39 mnemonic. Supply a keystore path and account name if desired; avoid --unsafe-password unless you understand the risk. Use --words/--accounts to control mnemonic length and derived accounts.
  11. cast wallet import \x3Cname> — import a private key or mnemonic into an encrypted keystore; by default it prompts for secrets, but you can pass --private-key, --mnemonic, --mnemonic-derivation-path, --mnemonic-index, --mnemonic-passphrase, or --keystore-dir.
  12. cast wallet list — show local keystore accounts; --dir points to a custom directory, and hardware flags unlock ledger/trezor lists.
  13. cast wallet address ... — derive the wallet address from a secret source (--interactive, --private-key, or --mnemonic).
  14. cast wallet sign / cast wallet verify — sign or verify messages/typed data. Provide the message and signer plus --private-key, --interactive, or --mnemonic; add --no-hash for raw hashes and --data/--from-file for EIP-712 JSON.
  15. cast parse-units \x3Camount> --decimals \x3Cn> — convert human-readable numbers (e.g., "1.5 USDC") to base units for ERC-20 transfers.
  16. cast format-units — convert base integers back into decimals given token decimals.
  17. cast to-unit / cast to-wei — ETH unit conversions; specify target unit (wei, gwei, ether, etc.) or use cast to-wei as a shortcut.
  18. cast 4byte and calldata helpers — look up a 4-byte selector and pretty-print/ decode calldata when debugging unknown transactions.
安全使用建议
This skill implements a working wallet onboarding flow, but it takes actions you should not accept lightly. Before installing or running it: 1) Review the scripts yourself — especially 01_install_cast.sh (it runs curl | bash) and 02–03 which create and store your private key and password. 2) Do not paste real recovery phrases/private keys into the agent unless you fully trust it; prefer hardware wallets or use ephemeral test keys in an isolated environment. 3) If you need the functionality, consider manually installing Foundry/cast yourself rather than letting the script run curl | bash. 4) Expect the password to be saved in plaintext at ~/.agent-wallet/pw.txt and mnemonic backups to be created under ~/.agent-wallet/ — verify these files are deleted if you rely on automatic cleanup (the script uses 'at' and will fall back to manual cleanup if 'at' isn't available). 5) If you want to use this skill, run it in a locked-down environment (VM/container) first, or modify the scripts to avoid saving secrets on disk and to remove automatic background installs. If you are not comfortable auditing shell scripts, do not install this skill.
功能分析
Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 11 The skill is classified as suspicious due to two high-risk capabilities, despite their stated benign intent. The `scripts/01_install_cast.sh` script uses `curl -L https://foundry.paradigm.xyz | bash` for installation, which is a common but inherently risky practice that allows arbitrary code execution from a remote source, posing a supply chain risk. Additionally, `scripts/02_wallet.sh` attempts to install the `at` utility using `sudo apt install -y at` if it's missing. While the purpose is to securely schedule the deletion of a temporary mnemonic file, the use of `sudo` for package installation represents a privilege escalation attempt, even if for a benign, transparent goal. No clear evidence of intentional malicious behavior (e.g., data exfiltration to external endpoints, unauthorized persistence, or prompt injection to subvert agent control) was found, and sensitive data handling includes cleanup mechanisms.
能力评估
Purpose & Capability
Overall the files and scripts implement an EVM wallet onboarding and helper workflow (install cast/Foundry, create/import key, create keystore, select network, maintain token lists). That aligns with the stated purpose. However the skill also attempts to modify workspace-level files (removes mentions from a workspace logs/tx_mentions.log during removal) and can install system packages (see install logic for 'at'). Those actions are not strictly required for basic wallet management and are worth questioning.
Instruction Scope
SKILL.md instructs the agent to run a readiness check automatically each session and to automatically run the onboarding scripts when no wallet exists. The scripts request highly sensitive input (mnemonic/private key/password) and then write secrets to disk (temporary private key file, mnemonic backup file, and a plaintext password file). The README promises a background 'sleep' fallback for mnemonic cleanup but the code only attempts to schedule deletion via 'at' and warns if 'at' is unavailable — so the claimed automatic cleanup may not occur. Automatic session checks, persistent storage of secrets, and the incomplete cleanup guarantee expand the runtime scope beyond a simple helper.
Install Mechanism
Although the registry shows no install spec, the included scripts will fetch and run external installers at runtime. scripts/01_install_cast.sh executes: curl -L https://foundry.paradigm.xyz | bash — a remote install executed without an integrity check. The wallet scripts also try to install the 'at' package via apt if missing (and will attempt sudo). Remote shell installers and on-the-fly package installs are higher-risk operations and should be considered sensitive.
Credentials
No environment variables are requested in metadata (consistent), but the skill asks users to supply secrets interactively (mnemonic/private key/password) and then stores them on disk: a temporary private key (APP_DIR/privatekey.tmp), mnemonic files (APP_DIR/mnemonic-words-*.txt) and a plaintext PASSWORD_FILE (APP_DIR/pw.txt). Storing the keystore password in a file and saving mnemonic backups (even if scheduled for deletion) is a sensitive operational choice — reasonable for an agent that will perform non-interactive sends, but disproportionate relative to a read-only assistant and risky without explicit user consent and secure storage warnings.
Persistence & Privilege
The skill is not force-enabled (always: false). SKILL.md instructs the agent to run scripts/check_wallet.sh automatically each session and to perform onboarding automatically when no wallet exists; this means the agent may autonomously access stored wallet metadata and call RPC endpoints (for balances). Autonomous invocation is permitted by default, but combined with automatic checks and the ability to accept/store secrets, it increases the operational blast radius. The skill does not request system-wide config changes beyond writing its own files and optionally installing packages via apt.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawcast-wallet
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawcast-wallet 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release of clawcast-wallet: an interactive skill for managing EVM wallets and transactions with cast. - Guides users step-by-step through wallet onboarding, including creation/import, encryption, network, and token setup, all driven by user-supplied inputs. - Automatically checks for an existing wallet and shows address, network, and balance at session start. - Provides scripts for wallet health checks, network status, and safe wallet removal. - Logs transaction mentions for later reference in a dedicated log file. - Shares direct explorer URLs for manual transaction review when API access is unavailable. - Focuses on clarity and ease of use, avoiding technical jargon unless requested.
元数据
Slug clawcast-wallet
版本 1.0.0
许可证
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Clawcast - Cast Ethereum Wallet for Agents 是什么?

Skill for managing EVM wallets, transactions, and network helpers via cast; covers onboarding, checks, and operating procedures. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 1358 次。

如何安装 Clawcast - Cast Ethereum Wallet for Agents?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawcast-wallet」即可一键安装,无需额外配置。

Clawcast - Cast Ethereum Wallet for Agents 是免费的吗?

是的,Clawcast - Cast Ethereum Wallet for Agents 完全免费(开源免费),可自由下载、安装和使用。

Clawcast - Cast Ethereum Wallet for Agents 支持哪些平台?

Clawcast - Cast Ethereum Wallet for Agents 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Clawcast - Cast Ethereum Wallet for Agents?

由 te_za(@tezatezaz)开发并维护,当前版本 v1.0.0。

💬 留言讨论