Airdrop Hunter

虚拟币空投撸毛助手。当用户想了解空投项目、追踪潜在空投机会、获取交互教程、评估空投风险、管理多账号操作或查询最新空投资讯时使用。支持Layer 1/2公链、DeFi协议、AI项目、RWA等多种类型空投的分析与策略制定。

Key points to consider before installing: - Billing & hard-coded secret: The code contains a hard-coded SkillPay API key inside payment.py and the meta file declares SkillPay env variables. This means the skill will call an external billing endpoint (https://skillpay.me) and may attempt to charge per call. Hard-coded keys are a security/operational risk — they may be leaked, revoked, or abused. Ask the author to remove the embedded key and require the platform to supply credentials via explicitly declared environment variables. - Metadata inconsistency: The registry summary claims no required env vars, but _meta.json and payment.py indicate billing credentials are required. This mismatch could cause surprise billing behavior. Confirm what credentials (if any) you must provide and how payments are authorized. - Network calls: The skill will perform live web searches and call the SkillPay API. If you require an offline or air-gapped environment, this skill is not suitable. - Scripts that automate wallets: The included references and example scripts show patterns (web3, Selenium, prompts to store mnemonics) that could lead users to handle private keys. Never paste your private keys or mnemonics into third-party code or into the skill. Prefer using hardware wallets for any real funds and keep 'action' wallets separate from 'scripting' wallets. - Operational & legal caution: The skill advises techniques for multi-account/anti‑association (fingerprint browsers, residential proxies). Those techniques can be ethically or legally questionable and increase risk of account bans and loss. Consider compliance and terms-of-service implications for services you interact with. Recommended immediate actions: 1. Ask the publisher to explain the billing flow and remove the hard-coded API key (move to a declared env var or platform-managed secret). 2. Require the skill to declare required env vars and present a clear consent/confirmation step before any network charge is attempted. 3. Audit or sandbox the skill: run it in an isolated environment first and monitor outgoing network requests (confirm only skillpay.me and expected web searches are contacted). 4. Never provide private keys or secrets to the skill; treat any requests for mnemonics or private keys as a blocking security issue. If the developer cannot remove the embedded API key and clarify the billing behavior, do not install the skill in production or with any credentials you care about.

Type: OpenClaw Skill Name: shenmeng-airdrop-hunter Version: 1.3.1 The skill bundle is a comprehensive assistant for cryptocurrency airdrop hunting, providing project tracking, scoring, and ROI calculation tools. It includes a functional billing integration in 'payment.py' that uses a third-party API (skillpay.me) to manage usage fees, which is clearly disclosed in 'SKILL.md'. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the provided scripts and documentation (e.g., 'monad-tutorial.md', 'project_scorer.py') are consistent with the stated purpose of assisting users in the crypto ecosystem.