Near Batch Sender

Batch operations for NEAR tokens - send to multiple recipients, transfer NFTs, claim rewards with cost estimation.

This skill implements the advertised NEAR batch operations but you should be cautious before installing or running it. Key points: - The metadata does NOT declare that the 'near' CLI is required, but the script calls 'near' via shell exec; ensure you have NEAR CLI installed and understand which local keys/credentials it will use (e.g., ~/.near-credentials). Treat that as an implicit required dependency. - The script builds shell commands by interpolating values from your JSON files directly into exec() calls. That is a command-injection risk: if any account, token_id, contract, or amount contains unexpected characters, an attacker controlling the JSON could run arbitrary shell commands. Only run this tool with trusted input files, or sanitize/validate inputs before use. - The 'claim' operation is not implemented in the script; it warns that protocol-specific integration is required. - Recommendations before use: review the script yourself (or run in a safe/test environment), run with a test account and small amounts first, ensure your NEAR CLI keys are secured, and consider reimplementing the command execution to call NEAR RPCs or use a native SDK / spawn with argument arrays (to avoid shell interpolation) rather than string-passed exec. If you expect the agent to call this autonomously, restrict autonomous invocation until you are comfortable with these risks.

Type: OpenClaw Skill Name: near-batch-sender Version: 1.0.0 The `scripts/batch.js` file uses `child_process.exec` to run `near` CLI commands. Inputs such as `senderAccount` (from command-line arguments) and values from the input JSON files (e.g., `recipient.account`, `transfer.contract`) are directly interpolated into shell commands without proper sanitization. This creates a severe shell injection vulnerability, allowing an attacker to execute arbitrary commands on the system by crafting malicious input, which could lead to data exfiltration or other unauthorized actions.