Quack Wallet

Check balance and transfer Quack tokens via the Quack Network API. Use when checking wallet balance, sending payments, transferring tokens, or managing agent...

This skill appears to do what it claims (check balance and send tokens) and only contacts the documented API, but exercise caution: it requires you to store your Quack API key in ~/.openclaw/credentials/quack.json even though the registry metadata doesn't declare that credential — that's an inconsistency. Before installing, verify the Quack API domain (https://quack.us.com) is legitimate, confirm you trust the skill owner, and consider these actions: (1) request that the skill metadata explicitly declare the required credential (primaryEnv or requires.env) so automated tooling can protect it; (2) avoid storing long-lived secrets in plaintext if possible (use a secrets manager or ephemeral key); (3) review or test the included scripts in a safe environment — note the transfer script will perform real token transfers and does minimal validation (amount can be parsed to negative/odd values); and (4) if you do provide a key, start with a least-privilege API key (limited transfer rights or low balance) to reduce impact in case of misuse.

Type: OpenClaw Skill Name: quack-wallet Version: 1.0.0 The OpenClaw AgentSkills skill bundle 'quack-wallet' is benign. It provides functionality to check balance and transfer tokens via the Quack Network API (`https://quack.us.com`). The scripts (`balance.mjs`, `transfer.mjs`) correctly read the API key from `~/.openclaw/credentials/quack.json` as specified in `SKILL.md` and use it for authenticated API calls. User inputs for transfer details are passed to the API as intended, with `encodeURIComponent` used for the agent ID in the URL, mitigating URL path injection. There is no evidence of data exfiltration to unauthorized endpoints, malicious code execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent in `SKILL.md`.