← 返回 Skills 市场

clawrtc

Name: clawrtc
Author: scottcjn

作者 AutoJanitor · GitHub ↗ · v1.5.0

cross-platform ⚠ suspicious

606

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawrtc-pip

功能描述

Mine RTC tokens by proving your hardware's authenticity with cryptographic checks and automated RustChain network attestation.

使用说明 (SKILL.md)

ClawRTC\r

\r Mine RTC tokens with your AI agent using Proof-of-Antiquity consensus.\r \r

What It Does\r

One-command setup: pip install clawrtc && clawrtc install --wallet my-agent\r
Hardware fingerprinting: 6 cryptographic checks prove your machine is real (clock drift, cache timing, SIMD identity, thermal entropy, instruction jitter, anti-emulation)\r
Automatic attestation: Attests to the RustChain network every few minutes\r
Per-epoch rewards: RTC tokens accumulate in your wallet each epoch (~10 minutes)\r
VM detection: Virtual machines are detected and receive effectively zero rewards\r \r

Security\r

No post-install telemetry — no network calls during pip install\r
TLS verification enabled — all RustChain API calls verify SSL certificates (CA-signed)\r
Bundled code only — all miner scripts ship with the package, no external downloads\r
Consent required — interactive approval prompt before installation\r
Dry-run mode — clawrtc install --dry-run previews without installing\r
Hash verification — clawrtc install --verify shows SHA256 of all bundled files\r
Clean uninstall — clawrtc uninstall removes all files, services, and configs\r
No background service by default — must explicitly pass --service to enable\r
Source available — full source at https://github.com/Scottcjn/Rustchain (MIT)\r \r

What Data Is Sent\r

\r During attestation (when mining), the following is sent to the RustChain node:\r \r

CPU model name and architecture (e.g. "AMD Ryzen 5", "x86_64")\r
Clock timing variance (proves real oscillator)\r
Cache latency profile (proves real L1/L2/L3 hierarchy)\r
VM detection flags (hypervisor yes/no)\r
Wallet name (your chosen identifier)\r \r NOT sent: file contents, browsing history, credentials, IP geolocation, personal data.\r \r

Install\r

pip install clawrtc\r
```\r
\r
## Usage\r
\r
```bash\r
# Install miner + configure wallet\r
clawrtc install --wallet my-agent\r
\r
# Start mining (foreground)\r
clawrtc start\r
\r
# Check status\r
clawrtc status\r
\r
# View logs\r
clawrtc logs\r
\r
# Stop mining\r
clawrtc stop\r
\r
# Clean uninstall\r
clawrtc uninstall\r
```\r
\r
## Multipliers\r
\r
| Hardware | Multiplier |\r
|----------|-----------|\r
| Modern x86/ARM | 1.0x |\r
| Apple Silicon (M1-M3) | 1.2x |\r
| PowerPC G5 | 2.0x |\r
| PowerPC G4 | 2.5x |\r
| VM/Emulator | ~0x (detected and penalized) |\r
\r
## Coinbase Wallet (v1.5.0)\r
\r
```bash\r
# Create a Coinbase Base wallet\r
pip install clawrtc[coinbase]\r
clawrtc wallet coinbase create\r
\r
# Show wallet info\r
clawrtc wallet coinbase show\r
\r
# Link existing Base address\r
clawrtc wallet coinbase link 0xYourBaseAddress\r
\r
# USDC → wRTC swap guide\r
clawrtc wallet coinbase swap-info\r
```\r
\r
Requires CDP credentials from [portal.cdp.coinbase.com](https://portal.cdp.coinbase.com) for auto-creation. Manual linking works without credentials.\r
\r
## Links\r
\r
- Source: https://github.com/Scottcjn/Rustchain\r
- PyPI: https://pypi.org/project/clawrtc/\r
- npm: https://www.npmjs.com/package/clawrtc\r
- Block Explorer: https://rustchain.org/explorer\r
- Agent Wallets: https://rustchain.org/wallets.html\r
- RustChain: https://rustchain.org\r
- BoTTube: https://bottube.ai\r

安全使用建议

This package largely does what it describes (hardware fingerprinting + attestation) but makes misleading privacy statements. Before installing: 1) Treat MAC addresses, hostname, and timing samples as identifying data — the miner sends them to an external node (NODE_URL) and the node will observe your IP. 2) Use --dry-run and --verify to inspect hashes and behavior first. 3) Inspect the upstream source (the GitHub repo referenced) and confirm the node domain/IP are legitimate. 4) If you value privacy, run it in an isolated environment (air-gapped or disposable VM/container) and do not enable persistent service or automatic enrollment. 5) If using Coinbase wallet features, protect CDP credentials (they are optional but sensitive). 6) If you allow the agent to invoke skills autonomously, be aware this skill has network access and will periodically call the external attestation endpoint — limit autonomous invocation or monitor network calls. If you need full assurance, do not install until the node/operator identity and data retention/policy are verified.

功能分析

Type: OpenClaw Skill Name: clawrtc-pip Version: 1.5.0 The skill bundle is classified as suspicious primarily due to a critical shell injection vulnerability (RCE risk) in `clawrtc/cli.py`. The `_setup_systemd` function directly inserts the user-provided or auto-generated `wallet` name into the `ExecStart` command of a systemd service file without proper sanitization. This allows for arbitrary command execution if a malicious `wallet` name containing shell metacharacters is provided. A minor discrepancy also exists where `SKILL.md` claims 'No post-install telemetry', but `clawrtc/cli.py` sends anonymous install telemetry to `https://bottube.ai/api/telemetry/install`. While the core functionality of hardware fingerprinting and mining aligns with the stated purpose, the RCE vulnerability is a significant security flaw.

能力评估

✓ Purpose & Capability

Code implements the stated purpose: local fingerprinting, attestation, and periodic HTTP calls to a RustChain node to earn tokens. Commands run (lscpu, nproc, ip/ifconfig, sysctl) and filesystem reads (/proc, /sys) are consistent with hardware fingerprinting and VM detection.

⚠ Instruction Scope

SKILL.md claims 'No post-install telemetry' and 'No personal data sent', but the miner code sends MAC addresses, hostname, timing entropy samples, CPU model, and other fingerprint data to NODE_URL (/attest/*). Network-level metadata (your IP) will also be visible to the node. The README and SKILL.md also reference different endpoints (IP vs domain), which is inconsistent and should be clarified.

ℹ Install Mechanism

There is no special install spec in the registry; installation is via pip (as the SKILL.md instructs). The package bundles miner scripts (no external downloads during install), creates a venv, and installs dependencies (requests, cryptography). This is expected for a Python miner; installing dependencies will cause normal network activity via pip.

⚠ Credentials

The skill declares no required environment variables, but optional Coinbase wallet functionality depends on CDP_API_KEY_NAME and CDP_API_KEY_PRIVATE_KEY. The miner reads many system files and environment keys (KUBERNETES, DOCKER, VIRTUAL, container) for VM detection and collects MAC addresses and hostname — these are identifying and arguably 'personal' data despite SKILL.md claiming otherwise.

ℹ Persistence & Privilege

always:false and background service is opt-in ('--service'). The installer writes to the user home (~/.clawrtc), creates a venv and can install a per-user systemd/LaunchAgent service if requested. It does not request elevated or system-wide privileges by default, but it does create persistent files/services in the user account.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawrtc-pip
安装完成后，直接呼叫该 Skill 的名称或使用 /clawrtc-pip 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.5.0

ClawRTC 1.5.0 introduces native Coinbase Base wallet support and security enhancements. - New: Coinbase wallet support—create, link, and manage Base addresses directly from the CLI. - New: USDC to wRTC swap guide for on-chain integration. - Security: Explicit details on what data is (and is not) sent during attestation. - Security: Hash verification and dry-run mode for transparent installs. - Privacy: No post-install telemetry and explicit consent prompt before installing. - Docs: Expanded setup, usage, and hardware multiplier descriptions.

元数据

Slug clawrtc-pip

版本 1.5.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题

clawrtc 是什么？

Mine RTC tokens by proving your hardware's authenticity with cryptographic checks and automated RustChain network attestation. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 606 次。

如何安装 clawrtc？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawrtc-pip」即可一键安装，无需额外配置。

clawrtc 是免费的吗？

是的，clawrtc 完全免费（开源免费），可自由下载、安装和使用。

clawrtc 支持哪些平台？

clawrtc 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 clawrtc？

由 AutoJanitor（@scottcjn）开发并维护，当前版本 v1.5.0。