← 返回 Skills 市场
mountainmystic

HederaToolbox

作者 mountainmystic · GitHub ↗ · v1.0.3 · MIT-0
cross-platform ⚠ suspicious
255
总下载
0
收藏
0
当前安装
4
版本数
在 OpenClaw 中安装
/install hederatoolbox
功能描述
Query live Hedera blockchain data — token prices, whale movements, HCS topics, governance proposals, identity/KYC screening, and smart contract analysis. Pay...
使用说明 (SKILL.md)

HederaToolbox

Query live Hedera blockchain data using AI-native, pay-per-call tools. No registration, no API keys to manage — send HBAR to the platform wallet once, and your Hedera account ID becomes your permanent key.

What This Skill Does

When active, your agent can call 20 Hedera blockchain tools across 6 modules:

  • Token — HBAR/token price, whale movement alerts, deep token analysis
  • HCS — Query and monitor Hedera Consensus Service topics, anomaly detection
  • Compliance — Write and verify tamper-proof audit records on HCS
  • Identity — Resolve accounts, verify KYC status, sanctions screening
  • Governance — Monitor and analyze active proposals and vote splits
  • Contract — Read state, call functions, analyze smart contract activity

Setup (One Time)

  1. Get your Hedera account ID — format 0.0.XXXXXX. Any mainnet account works.
  2. Fund your balance — Send HBAR to the platform wallet 0.0.10309126 from your account. Your account ID becomes your API key within 10 seconds.
  3. Set the env var — Add HEDERA_ACCOUNT_ID=0.0.XXXXXX to your OpenClaw config.

Recommended starting balance: 10 HBAR (~$0.96 at current prices)

At 10 HBAR you get approximately:

  • 50 token price checks (0.10 ħ each), or
  • 13 deep token analyses (0.60 ħ each), or
  • A full compliance onboarding workflow (identity_resolve + identity_verify_kyc + identity_check_sanctions + hcs_write_record ≈ 6.70 ħ), or
  • Roughly 8 complete scheduled agent runs at the X agent profile (≈1.15 ħ/run)

Send more at any time — balance tops up within 10 seconds.

Security & Trust

Your private key is never requested, stored, or transmitted. This skill only uses your public Hedera account ID (0.0.XXXXXX). No wallet signing is required at any point.

How payment verification works: The platform runs a deposit watcher that polls the Hedera Mirror Node every 10 seconds for incoming transfers to the platform wallet (0.0.10309126). Hedera transactions cryptographically record the sender account ID on-chain — no memo or transaction hash is required from you. When a transfer is detected from your account, your balance is credited automatically. You can verify any deposit on Hashscan: https://hashscan.io/mainnet/account/0.0.10309126. The watcher source code is at https://github.com/mountainmystic/hederatoolbox/blob/master/src/watcher.js.

"Permanent key" clarification: Your Hedera account ID is a persistent billing identifier — not a cryptographic credential. The platform tracks which account sent HBAR using on-chain transaction records from the Mirror Node. Only the account that deposited HBAR can spend that balance.

On-chain writes: Tools like hcs_write_record write HCS messages signed by the platform operator key (server-side, using the platform's own Hedera account). Your account ID is included in the message payload as the originator field — it is metadata, not a transaction signer. The transaction itself is signed by and appears on-chain as originating from the platform account (0.0.10309126), not yours. This is standard for metered API services on Hedera.

Payment model: You send HBAR using your own wallet (HashPack, Blade, CLI, etc.) before using the skill. The skill itself never initiates transfers or requests funds. All charges are deducted from your pre-funded balance only — the platform cannot pull additional funds from your wallet.

Data sent off-platform: Tool calls (account IDs, contract addresses, token IDs, query parameters) are sent to api.hederatoolbox.com. See the Privacy Policy at https://hederatoolbox.com/privacy.html for retention and sharing details.

Start small: Test with 2–5 HBAR before committing more. Full source: https://github.com/mountainmystic/hederatoolbox

Tool Pricing (HBAR)

Module Tool Cost
Free get_terms, confirm_terms, account_info 0 ħ
HCS hcs_monitor, hcs_query 0.10 ħ
HCS hcs_understand 1.00 ħ
Compliance hcs_write_record 5.00 ħ
Compliance hcs_verify_record 1.00 ħ
Compliance hcs_audit_trail 2.00 ħ
Governance governance_monitor 0.20 ħ
Governance governance_analyze 1.00 ħ
Token token_price 0.10 ħ
Token token_monitor 0.20 ħ
Token token_analyze 0.60 ħ
Identity identity_resolve 0.20 ħ
Identity identity_verify_kyc 0.50 ħ
Identity identity_check_sanctions 1.00 ħ
Contract contract_read 0.20 ħ
Contract contract_call 1.00 ħ
Contract contract_analyze 1.50 ħ

MCP Endpoint

https://api.hederatoolbox.com/mcp

Standard MCP-over-HTTP. Compatible with any MCP client.

When To Use This Skill

Use HederaToolbox tools when the user asks about:

  • HBAR price or market datatoken_price
  • Whale activity or unusual transferstoken_monitor
  • Deep token risk analysistoken_analyze
  • Reading or monitoring an HCS topichcs_monitor or hcs_query
  • Detecting anomalies in HCS traffichcs_understand
  • Writing a compliance record on-chainhcs_write_record
  • Verifying an existing compliance recordhcs_verify_record
  • Full audit trail for an account or topichcs_audit_trail
  • Resolving a Hedera account identityidentity_resolve
  • KYC status for a tokenidentity_verify_kyc
  • Sanctions screeningidentity_check_sanctions
  • Active governance proposalsgovernance_monitor
  • Voter sentiment and participationgovernance_analyze
  • Smart contract statecontract_read
  • Calling a contract functioncontract_call
  • Contract activity patterns and riskcontract_analyze
  • Checking balance or platform infoaccount_info

Example Agent Prompts

Check the current HBAR price and look for any whale activity in the last hour.
Monitor HCS topic 0.0.10353855 and tell me if there's anything unusual.
Run a KYC check on account 0.0.7925398 for token 0.0.731861.
Analyze the SaucerSwap contract 0.0.1460200 and give me a risk summary.
What are the active governance proposals for SAUCE token right now?

Tool Call Format

All tools follow the same MCP pattern. Pass your account ID as api_key:

{
  "tool": "token_price",
  "arguments": {
    "tokenId": "0.0.1456986",
    "api_key": "0.0.YOUR_ACCOUNT_ID"
  }
}

The agent reads HEDERA_ACCOUNT_ID from the environment and passes it automatically.

Checking Your Balance

Ask the agent: "What's my HederaToolbox balance?"

This calls account_info (free) and returns your remaining balance in HBAR.

Topping Up

Send additional HBAR to 0.0.10309126 from your account at any time. Balance updates within 10 seconds.

What You Could Build

  • Compliance onboarding agent — resolve + KYC + sanctions + write HCS record for any Hedera account. Board-ready audit trail in one workflow (~6.70 ħ total).
  • Whale alert bot — run token_monitor on a schedule, surface unusual transfers to Telegram or Slack.
  • DAO governance digest — daily governance_monitor + governance_analyze summary for any token with active proposals.
  • Smart contract due diligencecontract_analyze + identity_resolve on all callers, output a risk report.
  • On-chain market pulsetoken_price + token_monitor twice daily, draft a tweet or Slack summary from the data.

Links

安全使用建议
Before installing or funding this skill: 1) Verify the platform wallet address and the GitHub watcher source code link (https://github.com/mountainmystic/hederatoolbox) independently to ensure they match the published project; 2) Start with a very small test deposit (the skill itself recommends 2–5 HBAR) to confirm the deposit-watcher credibly credits your balance and that API interactions work as described; 3) Read the privacy policy to understand what identity, KYC, or account data will be transmitted and retained by api.hederatoolbox.com; 4) Remember that HEDERA_ACCOUNT_ID is a public identifier — storing it in agent config is not a secret but may be visible to other skills or logs; 5) Confirm pricing and that you are comfortable the platform can only spend your pre-funded balance (not pull funds from your wallet); and 6) If you plan to use identity/KYC or hcs_write_record features, audit the vendor's GitHub repo and confirm the operator's identity/trustworthiness before submitting more than a small test amount.
功能分析
Type: OpenClaw Skill Name: hederatoolbox Version: 1.0.3 The skill implements a pay-per-call blockchain data service that uses a user's public Hedera Account ID as the sole authentication token ('api_key'). Because Hedera account IDs are public identifiers visible on any block explorer, this architectural flaw allows unauthorized third parties to potentially exhaust a user's pre-funded HBAR balance simply by knowing their account ID. While the skill does not exhibit intentional malicious behavior such as stealing private keys or local files, this weak authentication mechanism (SKILL.md) constitutes a significant security vulnerability.
能力评估
Purpose & Capability
The skill claims to provide Hedera data, monitoring, KYC/sanctions checks, and HCS writes and requests only a Hedera account ID. That single env var (a public account identifier) is consistent with a billing-by-deposit model where the platform tracks deposits on-chain.
Instruction Scope
SKILL.md instructs the user to fund a platform wallet externally and set HEDERA_ACCOUNT_ID in the OpenClaw config. It explicitly sends query parameters and account IDs to api.hederatoolbox.com and may transmit identity/KYC inputs to the platform. The instructions do not request private keys or local files, but they do direct potentially sensitive data (KYC info, account IDs) off-platform which is expected for the described features — verify the privacy policy and what data is sent.
Install Mechanism
Instruction-only skill with no install spec or code files; nothing is written to disk by the skill itself. This is the lowest-risk install mechanism.
Credentials
Only HEDERA_ACCOUNT_ID is required (a public identifier). That is proportionate to the stated deposit-based billing. However, the skill enables identity/KYC and sanctions checks which will require sending PII or identifiers to the platform's API; the SKILL.md acknowledges data is sent to api.hederatoolbox.com, so users should confirm privacy/retention policies and the legitimacy of the platform before submitting sensitive data or deposits.
Persistence & Privilege
always is false and the skill does not request elevated system privileges. It requires storing HEDERA_ACCOUNT_ID in agent config (normal for a primaryEnv). Be aware that any env var in an agent's config can be read by other skills or by the agent when invoked, but the stored value is a public account ID rather than a secret key.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install hederatoolbox
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /hederatoolbox 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.3
- Updated security and trust documentation to clarify account ID usage and HCS write operations. - Expanded explanation of how on-chain writes and message signing are handled, including clear distinction between metadata and transaction signer. - Minor edits for style, clarity, and improved accuracy in describing platform operations. - No functional or technical changes.
v1.0.2
### v1.0.2 Changelog - Security and payment handling sections have been expanded for greater clarity. - Now explicitly details how payment verification and deposit watching work with on-chain Hedera transactions. - Clarifies that the "permanent key" is your account ID used for platform balance (not for cryptographic authentication). - Rewords data privacy, wallet, and payment model descriptions for improved transparency and accuracy. - No functional or interface changes; documentation updates only.
v1.0.1
Version 1.0.1 - Added dedicated "Security & Trust" section detailing privacy, payment, and on-chain write policies. - Clarified that private keys are never requested or handled, and that all payments are manual user actions. - Added links to GitHub and Hashscan for platform wallet verification. - Expanded explanation of KYC/sanctions tools and on-chain record writes. - No changes to APIs or tool behavior.
v1.0.0
Initial release of HederaToolbox skill. - Provides 20 live Hedera blockchain tools across six modules: Token, HCS, Compliance, Identity, Governance, and Contract. - Pay-per-call access via HBAR micropayments—no signup or API keys required. - Includes features like token price checks, whale movement alerts, HCS topic monitoring, KYC/sanctions screening, governance tracking, and smart contract analysis. - Transparent tool-by-tool HBAR pricing, with instant balance top-up and free balance checking. - Agent setup requires only Hedera account ID and configuration of a single environment variable. - Supports standard MCP-over-HTTP endpoint for easy integration.
元数据
Slug hederatoolbox
版本 1.0.3
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 4
常见问题

HederaToolbox 是什么?

Query live Hedera blockchain data — token prices, whale movements, HCS topics, governance proposals, identity/KYC screening, and smart contract analysis. Pay... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 255 次。

如何安装 HederaToolbox?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install hederatoolbox」即可一键安装,无需额外配置。

HederaToolbox 是免费的吗?

是的,HederaToolbox 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

HederaToolbox 支持哪些平台?

HederaToolbox 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 HederaToolbox?

由 mountainmystic(@mountainmystic)开发并维护,当前版本 v1.0.3。

💬 留言讨论