← 返回 Skills 市场
stonega

Claw Earn

作者 stonega · GitHub ↗ · v1.2.0
cross-platform ⚠ suspicious
983
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install clawearn
功能描述
Modular prediction market trading platform for OpenClaw bots. Trade on Polymarket, manage wallets, transfer USDC, and automate trading strategies.
使用说明 (SKILL.md)

Clawearn - Modular Trading Platform for OpenClaw 🎯

Trade prediction markets directly from your OpenClaw bot.

Clawearn enables your AI agent to:

  • 🎯 Trade on Polymarket prediction markets
  • 💼 Create and manage crypto wallets
  • 💸 Send USDC to any Ethereum address on Arbitrum
  • 📊 Monitor balances and positions across markets
  • 🤖 Execute trading strategies autonomously

Quick Start (3 steps)

Step 1: Install clawearn CLI

curl -fsSL https://clawearn.xyz/install.sh | bash
# or: bun link (if in repo)

Step 2: Create your first wallet

clawearn wallet create

You'll see your wallet address. Save it — you'll need to fund it next.

Step 3: Fund your wallet and start trading

Option A: Send USDC from another wallet

clawearn wallet send --to YOUR_AGENT_ADDRESS --amount 100

Option B: Bridge USDC to Arbitrum yourself

  • Send USDC to Arbitrum network
  • Send to the address from clawearn wallet show

Then search for markets:

clawearn polymarket market search --query "bitcoin price 2025"

Installation for OpenClaw Bots

Install all skill files

# Create skill directory
mkdir -p ~/.openclaw/skills/clawearn

# Install main files
curl -s https://clawearn.xyz/skills/SKILL.md > ~/.openclaw/skills/clawearn/SKILL.md
curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.openclaw/skills/clawearn/HEARTBEAT.md

# Install core skills
mkdir -p ~/.openclaw/skills/clawearn/core/{wallet,security}
curl -s https://clawearn.xyz/skills/core/wallet/SKILL.md > ~/.openclaw/skills/clawearn/core/wallet/SKILL.md
curl -s https://clawearn.xyz/skills/core/security/SKILL.md > ~/.openclaw/skills/clawearn/core/security/SKILL.md

# Install market skills
mkdir -p ~/.openclaw/skills/clawearn/markets/polymarket
curl -s https://clawearn.xyz/skills/markets/polymarket/SKILL.md > ~/.openclaw/skills/clawearn/markets/polymarket/SKILL.md
curl -s https://clawearn.xyz/skills/markets/polymarket/HEARTBEAT.md > ~/.openclaw/skills/clawearn/markets/polymarket/HEARTBEAT.md

Supported Markets

Market Status Features Installation
Polymarket ✅ Production Full trading, order management, market discovery See above

Core Commands

Wallet Management

# Create a new wallet
clawearn wallet create

# Show your wallet address
clawearn wallet show

# Send USDC to another address (on Arbitrum)
clawearn wallet send --to 0x... --amount 100

Polymarket Trading

# Search for markets
clawearn polymarket market search --query "bitcoin price 2025"

# Get market details
clawearn polymarket market info --market-id MARKET_ID

# Check your balance
clawearn polymarket balance check

# Place a buy order
clawearn polymarket order buy --token-id TOKEN_ID --price 0.50 --size 10

# View open orders
clawearn polymarket order list-open

# Cancel an order
clawearn polymarket order cancel --order-id ORDER_ID

Configuration

Create an optional config file to track settings:

~/.clawearn/config.json (optional)

{
  "version": "1.1.0",
  "enabled_markets": ["polymarket"],
  "default_network": "arbitrum",
  "wallet": {
    "network": "arbitrum",
    "auto_fund_threshold": 50
  },
  "trading": {
    "signature_type": 0,
    "default_slippage_pct": 0.5
  },
  "risk_limits": {
    "max_position_size_pct": 20,
    "max_total_exposure_pct": 50,
    "min_balance_alert": 10,
    "daily_loss_limit": 100
  }
}

Quick Reference

Check installed markets

ls ~/.clawearn/skills/markets/

Update all skills

# Update core
curl -s http://localhost:3000/skills/SKILL.md > ~/.clawearn/skills/SKILL.md

# Update each enabled market
for market in $(cat ~/.clawearn/config.json | grep -o '"polymarket"'); do
  curl -s http://localhost:3000/skills/markets/$market/SKILL.md > ~/.clawearn/skills/markets/$market/SKILL.md
done

Add a new market

# 1. Install the skill files
mkdir -p ~/.clawearn/skills/markets/NEW_MARKET
curl -s http://localhost:3000/skills/markets/NEW_MARKET/SKILL.md > ~/.clawearn/skills/markets/NEW_MARKET/SKILL.md

# 2. Update your config.json to add "NEW_MARKET" to enabled_markets

# 3. Set up credentials following the market's SETUP.md

Security Best Practices

🔒 CRITICAL:

  • Read core/SECURITY.md before trading
  • Never share private keys
  • Store credentials securely
  • Use separate wallets for different markets
  • Enable 2FA where available

Getting Help

  • Core wallet issues: See core/WALLET.md
  • Security questions: See core/SECURITY.md
  • Market-specific help: See markets/{market}/README.md
  • General trading: See HEARTBEAT.md for routine checks

Check for updates: Re-fetch this file anytime to see newly supported markets!

curl -s https://clawearn.xyz/skills/SKILL.md | grep '^version:'

Ready to start? Install the core skills, choose your markets, and begin trading! 🚀

安全使用建议
Things to consider before installing/running this skill: - Do not run curl https://clawearn.xyz/install.sh | bash without reviewing the script first. Download it, inspect it, and only run after you understand what it will do. - The SKILL.md expects private keys and API tokens (POLYMARKET_PRIVATE_KEY, MANIFOLD_API_KEY, KALSHI_TOKEN) but the registry didn't declare them; assume you must provide secrets. Prefer hardware wallets, multisig, or keeping private keys offline; never paste private keys into commands or plaintext files unless you accept the risk. - The docs include commands that automatically send funds and grant unlimited USDC approval — test with very small amounts first. Unlimited ERC20 approvals are common but carry theft risk; consider revoking allowances or using limited approvals. - Some update commands point to http://localhost:3000 or have inconsistent paths — verify the correct update endpoints before running automated update snippets (these could be copy/paste mistakes that cause incorrect behavior). - Treat the remote host (clawearn.xyz) as high-privilege: it is used to deliver install scripts and skill files that you’ll write and execute locally. Verify the project's repository, read the install.sh, and prefer installing from a vetted package or from source you reviewed. - If you want to proceed: (1) audit the install.sh and any fetched SKILL.md/HEARTBEAT files, (2) run in an isolated/test environment first, (3) use small test funds, and (4) avoid exposing long-lived keys in environment variables or CLI arguments. Ask the publisher for a link to the install script and source code (the repo link in the SKILL.md points to github.com/stonega/moltearn — verify that repository contents match the install scripts and documentation).
功能分析
Type: OpenClaw Skill Name: clawearn Version: 1.2.0 The skill is classified as suspicious due to two primary indicators: 1) The installation instructions in `SKILL.md` and `README.md` use `curl -fsSL https://clawearn.xyz/install.sh | bash`, which is a high-risk method for executing arbitrary remote code and poses a significant supply chain vulnerability. 2) Both `SKILL.md` and `HEARTBEAT.md` contain instructions for the AI agent to update its own skill files from `http://localhost:3000`, which is a clear prompt injection vulnerability. An attacker controlling a local server could inject malicious code into the agent's skills. While the skill's stated purpose involves high-risk financial transactions (USDC transfers, deposits, withdrawals, gas refuels), these are aligned with its function as a trading bot, and the `core/security/SKILL.md` provides strong security warnings and best practices. However, the installation and update mechanisms introduce critical security weaknesses.
能力评估
Purpose & Capability
The name/description (prediction-market trading, Polymarket, wallet management) aligns with the commands in the SKILL.md. However the registry metadata declares no required environment variables while the skill repeatedly expects secrets such as POLYMARKET_PRIVATE_KEY, MANIFOLD_API_KEY, and KALSHI_TOKEN; this is an incoherence. The metadata lists bun and ethers.js as runtime requirements (plausible), but the documentation's update/install endpoints and some paths are inconsistent (https://clawearn.xyz vs http://localhost:3000).
Instruction Scope
The SKILL.md instructs the agent/user to download and write many files into ~/.openclaw/skills/... and ~/.clawearn/, to run a remote installer via curl | bash, and to pass private keys to CLI commands or store them in plaintext files. It also tells agent commands that automatically send funds (wallet send, withdraw with automatic bridge/send). Some instructions (e.g., using --private-key on CLI or echoing keys to files) increase exposure of secrets beyond what's strictly necessary and contradict the 'never share private keys' guidance elsewhere in the files. Update commands inconsistently reference localhost:3000 which is likely an error or misconfiguration and could cause unexpected behaviour if followed.
Install Mechanism
There is no formal install spec in the registry, but the docs tell you to run: curl -fsSL https://clawearn.xyz/install.sh | bash. Piping a remote install script into a shell is high-risk: the script could execute arbitrary code. The skill also instructs fetching SKILL.md and HEARTBEAT.md directly from the remote site and writing them into skill directories. These network-fetch-and-write steps are plausible for an instruction-only skill, but they are hazardous without code review of the install.sh and downloaded files.
Credentials
Registry claims no required env vars/primary credential, yet the runtime docs assume multiple secrets (private keys and API tokens) and show examples using $POLYMARKET_PRIVATE_KEY, MANIFOLD_API_KEY, and KALSHI_TOKEN, plus storing keys in ~/.config/clawearn. This mismatch (declared none vs. many implicit requirements) is suspicious and could mislead less technical users into exposing keys without realizing the skill needs them.
Persistence & Privilege
always:false (good). The skill is instruction-only and does not request forced inclusion. However the SKILL.md explicitly instructs writing files into ~/.openclaw/skills/ and ~/.clawearn/ and provides automated update commands that overwrite local skill files from remote URLs — this gives the remote site the ability to change files you later execute if you run their update commands. That is a normal pattern for installable tools but increases the risk if the remote host or install script is compromised.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawearn
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawearn 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.2.0
Support polymarket.
元数据
Slug clawearn
版本 1.2.0
许可证
累计安装 1
当前安装数 1
历史版本数 1
常见问题

Claw Earn 是什么?

Modular prediction market trading platform for OpenClaw bots. Trade on Polymarket, manage wallets, transfer USDC, and automate trading strategies. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 983 次。

如何安装 Claw Earn?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawearn」即可一键安装,无需额外配置。

Claw Earn 是免费的吗?

是的,Claw Earn 完全免费(开源免费),可自由下载、安装和使用。

Claw Earn 支持哪些平台?

Claw Earn 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Claw Earn?

由 stonega(@stonega)开发并维护,当前版本 v1.2.0。

💬 留言讨论