Openclaw Wallet

Multi-chain wallet and trading tools for AI agents. Provides 27 tools for: wallet management (create, balance, export keys), token swaps with flexible amounts ($100, 50%, max), cross-chain bridges, DEX market data (trending, volume, gainers/losers), token launches with tiered market caps, and fee management. Supports Solana and EVM chains. Use when agents need to interact with wallets, execute trades, research tokens, or launch tokens.

Before installing: (1) Treat this as high-risk: it can create wallets, handle seed phrases/private keys, and execute transactions. (2) Verify the npm package @loomlay/openclaw-wallet-plugin on npm and the GitHub repo — inspect the code and maintainers, confirm versions and signatures. (3) Do not rely on its 'auto-register' behavior: prefer setting LOOMLAY_API_KEY yourself and inspect ~/.loomlay/credentials.json after first run. (4) Require that the skill be user-invoked only and disable autonomous model invocation for any transaction-capable skill. (5) Consider using a hardware wallet or isolated environment for any live funds; never allow automated or background transfers without explicit, auditable user confirmation. (6) Ask the publisher to fix registry metadata to declare the required env vars and installation steps, and to document network endpoints and data retention for credentials. If you cannot review the package code and verify its provenance, avoid installing it on any machine with real funds or sensitive keys.

Type: OpenClaw Skill Name: openclaw-wallet Version: 0.1.5 The skill bundle is classified as suspicious due to its extensive high-risk capabilities, despite including security best practices. The `SKILL.md` file instructs the AI agent to handle extremely sensitive data like cryptocurrency seed phrases and private keys (via `wallet_create` and `wallet_export_keys`), perform irreversible financial transactions (swaps, transfers, bridges), launch tokens, and execute arbitrary RPC calls to blockchain nodes. It also involves installing an external npm package (`@loomlay/openclaw-wallet-plugin`) and managing credentials in `~/.loomlay/credentials.json`. While these capabilities are aligned with the stated purpose of a multi-chain wallet tool, they present a significant attack surface for prompt injection, allowing an attacker to potentially trick the agent into misusing these powerful tools for unauthorized actions or data exposure.