← 返回 Skills 市场
769
总下载
0
收藏
1
当前安装
9
版本数
在 OpenClaw 中安装
/install clawcontract
功能描述
AI-powered smart contract generator, analyzer, and deployer for BNB Chain (BSC/opBNB). Use when you need to generate Solidity from natural language, run secu...
使用说明 (SKILL.md)
ClawContract
Generate, analyze, deploy, and verify smart contracts on BNB Chain via CLI.
Source & install: \x3Chttps://github.com/cvpfus/clawcontract> — clone the repo, run pnpm install && pnpm build && npm link.
Quick Start
Generate a contract:
clawcontract generate "escrow contract for peer to peer trades with dispute resolution and timeout auto release"
Full pipeline (generate → analyze → deploy → verify):
clawcontract full "escrow contract for peer to peer trades with dispute resolution and timeout auto release" --chain bsc-testnet
Deploy an existing contract:
clawcontract deploy ./contracts/VibeToken.sol --chain bsc-testnet
Interact with a deployed contract:
clawcontract interact 0xABC... name --chain bsc-testnet
List deployment records:
clawcontract list
clawcontract list --chain bsc-testnet
Delete a deployment record:
clawcontract delete 0xABC...def
References
- Full command reference (all flags, examples, notes): See
{baseDir}/references/commands.md
Supported Chains
| Key | Chain | Testnet |
|---|---|---|
bsc-mainnet |
BNB Smart Chain | No |
bsc-testnet |
BNB Smart Chain Testnet | Yes |
opbnb-mainnet |
opBNB | No |
opbnb-testnet |
opBNB Testnet | Yes |
Default: bsc-testnet.
Env Vars
Configure via docker-compose.yml or set directly in the environment.
| Variable | Required | Purpose |
|---|---|---|
CLAWCONTRACT_OPENROUTER_API_KEY |
Yes | AI contract generation |
CLAWCONTRACT_PRIVATE_KEY |
For deploy | Wallet for deployment — must be supplied by user |
CLAWCONTRACT_BSCSCAN_API_KEY |
For verify | Contract verification on BscScan/opBNBScan |
CLAWCONTRACT_OPENROUTER_MODEL |
No | Model override (default: anthropic/claude-sonnet-4-20250514) |
Artifacts
The CLI writes the following files to disk during normal operation:
| Path | When | Contents |
|---|---|---|
contracts/*.sol |
generate, full |
Generated Solidity source |
.deployments/*.json |
deploy, full |
Deployment metadata (address, chain, tx hash) |
Safety
- No auto-generated keys.
CLAWCONTRACT_PRIVATE_KEYmust be explicitly provided by the user via environment variable. The CLI will not generate or persist a private key on its own. - Mainnet warning (non-blocking). Deployment to mainnet chains prints a bold warning about real costs but does not block on a prompt — the deploy proceeds automatically. This is by design: the CLI targets agent-driven pipelines where stdin is unavailable. Users control mainnet exposure by choosing
--chainexplicitly (default isbsc-testnet). deleteconfirmation prompt.deleteis the sole interactive command — it shows deployment details and asksRemove this deployment? (y/N). Use--forceto skip the prompt (agent-friendly). This is safe becausedeleteonly removes local metadata; it cannot affect on-chain state.- Automatic fix attempts. During
full, if high-severity issues are found the AI attempts to fix and re-analyze (up to 3 rounds). This means the agent may modify generated source before deploy. Mitigations:- Use
--skip-fixto disable auto-fix entirely. - Use
--skip-deployto review the final source and analysis before any on-chain action. - Fixes only target the generated file in
contracts/; no other files are modified.
- Use
- Accidental live-deploy risk. Because
CLAWCONTRACT_PRIVATE_KEYis mandatory for deploy and the default chain isbsc-testnet, accidental mainnet deploys require the user to both set a funded mainnet key and explicitly pass--chain bsc-mainnetor--chain opbnb-mainnet. Neither can happen silently. - Prefer testnet chains and throwaway keys for initial trials.
安全使用建议
This skill appears to do what it claims, but take these precautions before installing or running it: 1) Do not supply a funded mainnet private key unless you intentionally want the agent to be able to deploy live contracts — use testnet or throwaway keys for initial experiments. 2) Review the npm package source (https://github.com/cvpfus/clawcontract and the package contents) before npm installing to confirm there are no surprises. 3) If you want to prevent accidental deploys or automated code changes, run commands with --skip-deploy and/or --skip-fix when invoking the 'full' pipeline. 4) Treat CLAWCONTRACT_PRIVATE_KEY as highly sensitive (store it securely and avoid putting it in broad CI/CD environments). 5) Note the metadata minor inconsistency (primary credential not declared) — this is likely harmless but worth being aware of.
功能分析
Type: OpenClaw Skill
Name: clawcontract
Version: 1.0.8
This skill is classified as suspicious due to its inherent high-risk capabilities, including the generation, analysis, and deployment of smart contracts to blockchain networks, and the handling of sensitive private keys and API keys. While the documentation is transparent about these risks and provides safety measures (e.g., defaulting to testnet, requiring explicit mainnet configuration, disclosing AI-driven code modification), the potential for severe financial loss or smart contract vulnerabilities if the underlying `clawcontract` tool or AI logic is flawed, or if misused, warrants a 'suspicious' classification. There is no evidence of intentional malicious behavior such as data exfiltration, backdoors, or prompt injection against the agent to perform unauthorized actions.
能力评估
Purpose & Capability
Name/description, required binary (clawcontract), install spec (npm package), and required env vars (AI API key, private key for deploy, BscScan API key for verification) all align with a CLI that generates, analyzes, deploys, and verifies contracts on BNB chains. Minor metadata inconsistency: the registry primary credential field is 'none' while CLAWCONTRACT_PRIVATE_KEY is listed in requires.env, but this is a documentation/metadata mismatch rather than a functional mismatch.
Instruction Scope
SKILL.md is an instruction-only CLI wrapper that stays within scope: it runs clawcontract commands, writes generated source to ./contracts/, and stores deployment metadata in .deployments/. Notable agent-impacting behaviors: the full pipeline can auto-fix generated code (up to 3 attempts) and deploys automatically (no interactive blocking prompt for mainnet), which means an agent with access to a funded private key can perform live transactions without interactive confirmation. The README provides flags (--skip-deploy, --skip-fix) to reduce this risk.
Install Mechanism
Install uses an npm package named 'clawcontract' which creates the expected binary. This is a standard package install mechanism; it is traceable on npm/GitHub rather than pulling arbitrary archives from unknown hosts. As with any npm package, users should verify the package provenance and review the package contents before installation.
Credentials
The three required env vars (OPENROUTER API key for AI generation, PRIVATE_KEY for signing deployments, BSCSCAN API key for verification) are proportionate to the stated features. The PRIVATE_KEY is highly sensitive — only provide it when you intend to deploy, and prefer testnet or throwaway keys for trials. The metadata omission of a declared primary credential is a minor inconsistency.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills or system-wide settings. It writes files only to local contract and deployments paths described in SKILL.md. Autonomous invocation is allowed but is the platform default; combined with the required PRIVATE_KEY this gives the agent the ability to sign transactions, which is expected for a deployer CLI.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install clawcontract - 安装完成后，直接呼叫该 Skill 的名称或使用
/clawcontract触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.8
Version 1.0.8
- Updated safety documentation:
- Mainnet deployment now issues a warning but does not block on user prompt; deploy proceeds automatically, supporting agent-driven use cases.
- The `delete` command is now the only interactive prompt; use `--force` to bypass confirmation when deleting local deployment metadata.
- Clarified that automatic AI-powered security fixes only affect generated contract files and added instructions for disabling auto-fix or deployment.
- Explicitly described safeguards against accidental mainnet deployment—both a funded key and manual mainnet selection are required.
- Adjusted required environment variables; `CLAWCONTRACT_OPENROUTER_MODEL` is now optional.
v1.0.7
Version 1.0.7
- Updated required environment variable list to include CLAWCONTRACT_PRIVATE_KEY for deployment.
- No functional or code changes detected; documentation and metadata updates only.
v1.0.6
- Updated required environment variables: CLAWCONTRACT_PRIVATE_KEY is no longer required by default.
- CLAWCONTRACT_OPENROUTER_MODEL is now listed as a required environment variable.
- Installation metadata updated to reflect new environment variable requirements.
v1.0.5
- Updates required binaries and environment variables to accurately reflect the current dependencies.
- Removes the need for the separate "slither" binary and package from the installation instructions and requirements.
- Expands the list of required environment variables to include all relevant variables in the skill metadata.
- No functional changes to code; documentation and metadata only.
v1.0.4
- Updated environment variable names to use the CLAWCONTRACT_ prefix for all configuration and secrets.
- Added support for listing and deleting deployment records via new list and delete commands.
- Updated dependencies to require both clawcontract and slither binaries.
- Provided installation instructions for both node (clawcontract) and uv (slither-analyzer).
- Removed .env file generation, standardizing all configuration through environment variables.
- Improved documentation for environment setup, especially for docker-compose use cases.
v1.0.3
ClawContract 1.0.3 changelog
- Added `--skip-deploy` flag to the `full` command, allowing users to review generated contracts and analysis results before deploying.
- Added `--skip-fix` option to disable automatic fix attempts for high-severity analysis issues.
- Updated documentation for safety recommendations and flag usage.
v1.0.2
Version 1.0.2 of clawcontract
- No code or documentation changes detected in this release.
- No updates were made to the SKILL.md or implementation files.
v1.0.1
- Added explicit requirement for the OPENROUTER_API_KEY environment variable.
- Updated documentation to clarify that PRIVATE_KEY must be supplied by the user; auto-generation and persistence of deployment keys has been removed.
- Added homepage link and installation instructions referencing the official GitHub repository.
- Expanded documentation to detail CLI artifact output locations and when files are written.
- Improved and reorganized safety notes, emphasizing testnet use for trials and mandatory user-supplied keys.
v1.0.0
- Initial release of ClawContract: an AI-powered CLI tool for generating, analyzing, deploying, and verifying Solidity smart contracts on BNB Chain (BSC/opBNB).
- Supports contract generation from natural language, security analysis, compilation, deployment, source verification, and contract interaction.
- Works with both mainnet and testnet for BSC and opBNB.
- Includes fully non-interactive CLI operation with .env setup and multiple environment variable options.
- Safety features: automatic fixes for high-severity issues and extra deployment warnings on mainnets.
元数据
常见问题
clawcontract 是什么？
AI-powered smart contract generator, analyzer, and deployer for BNB Chain (BSC/opBNB). Use when you need to generate Solidity from natural language, run secu... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 769 次。
如何安装 clawcontract？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawcontract」即可一键安装，无需额外配置。
clawcontract 是免费的吗？
是的，clawcontract 完全免费（开源免费），可自由下载、安装和使用。
clawcontract 支持哪些平台？
clawcontract 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 clawcontract？
由 cvpfus（@sufnoobzac）开发并维护，当前版本 v1.0.8。
推荐 Skills