← 返回 Skills 市场
Polygon Agents SDK
作者
JamesLawton
· GitHub ↗
· v1.0.0
439
总下载
1
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install polygon-agents-sdk
功能描述
Complete Polygon agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity...
安全使用建议
This skill appears to implement what it claims, but it performs sensitive operations (generates/saves private keys, auto-downloads/executes cloudflared, exposes a public tunnel and temporary blobs). Before installing or running it: 1) Verify the upstream repo (https://github.com/0xPolygon/polygon-agent-kit) is authentic and review its code — especially any cloudflared download logic and where binaries are fetched from. 2) Prefer installing and running in an isolated environment (VM/container) rather than a primary machine. 3) Do not paste or share private keys or session blobs publicly; treat SEQUENCE_* keys as secrets. 4) If you must use it on a workstation, verify any downloaded binary checksums/signatures and consider using your own Cloudflare/connector setup instead of auto-tunnel. 5) If you lack comfort auditing the code, ask for a signed release or a package from a verifiable publisher before proceeding.
功能分析
Type: OpenClaw Skill
Name: polygon-agents-sdk
Version: 1.0.0
The skill bundle is classified as suspicious due to its instruction to automatically download and execute the `cloudflared` binary and establish a Cloudflare Quick Tunnel (`*.trycloudflare.com`) to expose a local HTTP server to the internet. While this mechanism is described as necessary for wallet session approval callbacks, the automatic execution of a third-party binary and creation of a public-facing tunnel without explicit user confirmation beyond the initial `npm install` introduces significant supply chain and network exposure risks, even if the stated intent is functional. This capability, detailed in SKILL.md and QUICKSTART.md, represents a high-risk behavior that could be exploited if the `cloudflared` binary or the local server were compromised.
能力评估
Purpose & Capability
Name, description, and the CLI commands in SKILL.md consistently describe a Polygon agent toolkit (wallet/session creation, token ops, ERC‑8004 registration). The declared environment variables in the docs (SEQUENCE_PROJECT_ACCESS_KEY, SEQUENCE_INDEXER_ACCESS_KEY, optional Trails keys) are appropriate for the described functionality.
Instruction Scope
The instructions require running a third‑party CLI (npm install -g github:0xPolygon/polygon-agent-kit) that will: create and store private keys, auto-open a Cloudflare Quick Tunnel, save session blobs to /tmp, and insist you transmit full approval URLs to users. Those actions are expected for a session-based wallet flow, but they broaden the agent's runtime surface (network-exposed tunnels, temporary plaintext blobs, local storage of private keys) and could enable attack vectors if the underlying code or downloaded binaries are malicious or tampered with.
Install Mechanism
SKILL.md instructs installation from a GitHub repo via npm (github:0xPolygon/polygon-agent-kit) — a common pattern but still fetches code at install time. More concerning: the CLI auto-downloads a cloudflared binary into ~/.polygon-agent/bin/ on first use. Auto-downloading and executing binaries from the network increases risk unless the source and integrity checks (signatures/checksums) are explicit. The registry metadata itself had no install spec or homepage listed, which reduces traceability.
Credentials
Required environment variables listed in SKILL.md (SEQUENCE_PROJECT_ACCESS_KEY and SEQUENCE_INDEXER_ACCESS_KEY) are directly relevant to wallet/session operations. Optional vars (TRAILS_API_KEY, TRAILS_TOKEN_MAP_JSON, debug flags) also make sense. The skill will output and ask you to save private keys and stores encrypted material in ~/.polygon-agent/ — expected, but these are high‑sensitivity secrets and the workflow involves temporary plaintext blobs in /tmp and URLs that must be copied exactly.
Persistence & Privilege
The skill is instruction-only and does not request always:true or other elevated platform privileges. However, the CLI behavior described will create persistent files under ~/.polygon-agent/ (encrypted storage and a bin folder for cloudflared) and write temporary files under /tmp; it also spawns a network tunnel. Those are normal for a CLI wallet but constitute persistent disk and network state that you should be willing to host on the machine used.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install polygon-agents-sdk - 安装完成后，直接呼叫该 Skill 的名称或使用
/polygon-agents-sdk触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial public release of polygon-agent-kit — an all-in-one toolkit for building Polygon smart agent experiences.
- Provides a session-based CLI for creating and managing smart contract wallets, sending, bridging and use tokens for any onchain action, onchain identity registration and reputation with 8004, and x402 micropayments.
- Encrypted local storage for wallet/session data with built-in smart sessions to control daily limits, thresholds, and contract calls to execute onchain transactions safely for your agent.
- Requires minimal env setup; operates via dry-run by default, with explicit broadcast mode for writes.
- Built-in interactive wallet creation/approval flow using Cloudflare Quick Tunnel for secure session handshakes.
- Supports troubleshooting, debug logging, flexible session controls, and robust funding/approval safeguards.
- Comprehensive built-in CLI reference and practical setup guides included for common flows
元数据
常见问题
Polygon Agents SDK 是什么？
Complete Polygon agent toolkit. Session-based smart contract wallets (Sequence), token ops (send/swap/bridge/deposit via Trails), ERC-8004 on-chain identity... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 439 次。
如何安装 Polygon Agents SDK？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install polygon-agents-sdk」即可一键安装，无需额外配置。
Polygon Agents SDK 是免费的吗？
是的，Polygon Agents SDK 完全免费（开源免费），可自由下载、安装和使用。
Polygon Agents SDK 支持哪些平台？
Polygon Agents SDK 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Polygon Agents SDK？
由 JamesLawton（@jameslawton）开发并维护，当前版本 v1.0.0。
推荐 Skills