← 返回 Skills 市场
567
总下载
0
收藏
3
当前安装
1
版本数
在 OpenClaw 中安装
/install passive-income-monitor
功能描述
Monitors and summarizes earnings from bandwidth nodes, decentralized storage, DeFi yields, and staking with alerts for drops or offline status.
安全使用建议
This package looks like documentation for a CLI monitor but contains no executable scripts or installation instructions in the bundle — that mismatch is the main red flag. Before installing or enabling this skill: (1) verify the source and obtain the actual tool code (install.sh and passive-income-monitor.sh) from a trusted repository; (2) inspect any scripts you install, especially any that accept wallets, keys, or write to your home config; never put private keys into the tool's config — use read-only addresses or API tokens with minimal scope; (3) be cautious with webhooks: only configure webhook URLs you control/trust to avoid leaking financial data; (4) if you want the agent to call the tool automatically, restrict that behavior until you confirm the tool's code and network destinations; and (5) prefer a skill that includes its code or an explicit, auditable install mechanism rather than an instruction-only entry that references missing files.
功能分析
Type: OpenClaw Skill
Name: passive-income-monitor
Version: 1.0.1
The skill bundle is classified as suspicious due to its handling of sensitive data and powerful network capabilities. It requires passing API keys and wallet addresses as command-line arguments and stores them in a configuration file, which can expose them to other processes or insecure file permissions. The skill also supports sending alerts to arbitrary webhook URLs and optionally uses Node.js for on-chain data, both of which are high-risk capabilities that could be exploited if the underlying scripts (not provided) are vulnerable. While the `SKILL.md` itself does not contain malicious prompt injections, it describes a tool with significant attack surface.
能力评估
Purpose & Capability
The SKILL.md describes a shell tool (passive-income-monitor.sh), an install.sh, and OpenClaw integration; however the skill bundle contains no code files or install instructions. The registry entry claims install via 'clawhub install' and manual install.sh, yet no install spec or code is present — meaning the skill as published cannot actually provide the promised monitoring functionality. Required binaries and env vars are listed in prose (curl, jq, bash) but not enforced or declared in metadata.
Instruction Scope
Instructions are generally scoped to monitoring tasks (calling public APIs, local RPC, writing config in ~/.config/passive-income-monitor, exporting CSVs, posting webhooks). Those actions are consistent with the stated purpose. However the SKILL.md explicitly mentions the agent can call the tool proactively during heartbeats and that alerts may POST to arbitrary webhook URLs — this raises a potential data-exfil risk if the agent is given unchecked access or misconfigured webhooks. Also the instructions assume the presence of local scripts and access to RPC endpoints and wallet/validator identifiers stored in config, which could expose sensitive data if private keys or privileged endpoints are used.
Install Mechanism
There is no install spec in the published skill (instruction-only), but the README instructs users to run 'clawhub install passive-income-monitor' or 'bash install.sh'. That is inconsistent: the package doesn't include install.sh or any script to install. This mismatch makes it unclear how an agent or user would obtain the binaries the instructions expect, and it is suspicious that the README prescribes installation steps that cannot be executed from the bundle.
Credentials
The skill declares no required environment variables or primary credential, which is reasonable for a passive monitor. The SKILL.md does mention optional API keys (e.g., Storj) and webhook URLs, but these are not declared in requires.env. The absence of declared env vars combined with instructions to add API keys in config is an inconsistency to be aware of. The commands example use wallet addresses (public) and RPC endpoints, which are expected for this domain — but the documentation does not warn about never storing private keys in the config, which would be a security risk.
Persistence & Privilege
The skill does not request always-on presence (always:false) and does not declare system-wide privileges. It writes its own config under ~/.config/passive-income-monitor and alert logs there — this is normal for a CLI tool. The note that the OpenClaw agent can call the tool during heartbeats is a capability the user should consider enabling or disabling, but autonomous invocation by itself is the platform default and not an immediate red flag.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install passive-income-monitor - 安装完成后，直接呼叫该 Skill 的名称或使用
/passive-income-monitor触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
- Fixed SKILL.md to accurately reflect initial release features, commands, and configuration for version 1.0.0.
- Clarified supported platforms, requirements, and alert methods.
- Improved usage documentation with command examples and example outputs.
- Ensured privacy and local data storage are clearly stated in the notes section.
元数据
常见问题
Passive Income Monitor 是什么？
Monitors and summarizes earnings from bandwidth nodes, decentralized storage, DeFi yields, and staking with alerts for drops or offline status. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 567 次。
如何安装 Passive Income Monitor？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install passive-income-monitor」即可一键安装，无需额外配置。
Passive Income Monitor 是免费的吗？
是的，Passive Income Monitor 完全免费（开源免费），可自由下载、安装和使用。
Passive Income Monitor 支持哪些平台？
Passive Income Monitor 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Passive Income Monitor？
由 mariusfit（@mariusfit）开发并维护，当前版本 v1.0.1。
推荐 Skills