Qfc Openclaw Skill

QFC blockchain interaction — wallet, faucet, chain queries, staking, epoch & finality, AI inference

This skill is largely coherent with its stated purpose (a full QFC wallet/chain + inference toolkit), but it has several items you should consider before installing or running: - Protect private keys: demo scripts ask you to export OWNER_PRIVATE_KEY; do not set or expose your mainnet private keys unless you fully trust and have audited the code. Prefer testnet keys and isolated wallets. - Keystore files: the skill saves encrypted keystores to ~/.openclaw/qfc-wallets/ (not declared in registry metadata). Verify the code that creates/reads these files and confirm the directory/permissions before use. - Avoid the global CLI patch: CLAUDE.md suggests editing a globally installed ClawHub JS file to 'work around' publishing behavior — do not apply that patch unless you understand and trust it; modifying global packages is risky. - Autonomous agent power: demos show issuing session keys and registering agents with Transfer permissions. If you enable autonomous invocation for this skill, limit permissions, use session keys with strict TTLs/daily caps, and test on testnet only. - Review network endpoints: the skill targets https://rpc.testnet.qfc.network and https://explorer.testnet.qfc.network; confirm these endpoints are legitimate and available to you. - Recommended steps before use: (1) review the keystore, agent-wallet, and demo scripts in src/ for any unexpected network endpoints or phone-home behavior; (2) run npm install and builds in a sandbox/container; (3) test only on testnet with throwaway wallets; (4) do not follow the global ClawHub patch unless you audit it. If you want, I can: (a) list the exact files that create/modify the keystore and show the code paths that write to ~/.openclaw, (b) extract the lines that instruct patching the ClawHub file, or (c) search the repo for any hard-coded external endpoints or 'eval'/'child_process' usage to give you a more concrete risk map.

Type: OpenClaw Skill Name: qfc Version: 3.4.0 The QFC OpenClaw Skill is a comprehensive blockchain interaction toolkit for the QFC network, providing features for wallet management, token/NFT deployment, and AI inference. It includes a robust security framework (src/security.ts) that enforces daily spending limits, transaction confirmations for large amounts, and address validation. While the skill handles sensitive operations like local encrypted wallet persistence (src/keystore.ts) and uses hardcoded bytecodes for contract deployments (src/token.ts, src/nft.ts), these actions are well-documented, aligned with the stated purpose, and include defensive instructions for the AI agent to prevent the exposure of private keys or unauthorized transactions.