Upload Clawhub

Execute DeFi transactions on BSC via SHLL AgentNFA. The AI handles all commands and users only need to chat.

Before installing or enabling this skill: - Do not reuse any main/owner/private wallets. If you test, create a dedicated operator wallet with minimal BNB (as the SKILL.md recommends). - Resolve the metadata mismatch: the platform metadata lists no required env vars but SKILL.md requires RUNNER_PRIVATE_KEY. Ask the publisher to correct the registry entry and explain how the key is supplied at runtime. - Never paste your main private key into chat. Prefer ephemeral keys or local environment variables managed by you, not written into persistent agent config files. - The SKILL.md recommends writing RUNNER_PRIVATE_KEY into agent config files (e.g., Claude/Cursor). Avoid storing a private key in plaintext config files — request alternative signing workflows (local signer, hardware wallet, or ephemeral session only) or confirm that the key is encrypted at rest and not uploaded anywhere. - Verify the on-chain contract addresses and review the PolicyGuard contract on BscScan (the SKILL.md gives an address; independently confirm the published source matches expected behavior). - If you plan to install the npm package, audit the package source code (GitHub repo and published tarball) locally before running it; prefer installing in an isolated VM/container. - Ask the developer how the agent receives and stores the RUNNER_PRIVATE_KEY at runtime, whether it performs any network calls with the key, and whether any logs might leak it. - If you are not comfortable with storing or letting an agent handle a private key, do not install the skill. Consider read-only alternatives or strictly manual signing flows. Providing these clarifications and mitigations to the skill author (or withholding enabling the skill until answered) will reduce the risk of accidental key exposure.

Type: OpenClaw Skill Name: shll-skills Version: 6.0.5 The bundle provides a DeFi execution toolkit (CLI and MCP) for the BNB Chain, centered around a dual-wallet architecture and on-chain policy enforcement via a 'PolicyGuard' contract. The instructions in SKILL.md and README.md are heavily focused on security, explicitly directing the AI agent to use a restricted 'operator' wallet for gas only, to never handle the user's owner private key, and to require user confirmation for all write operations. While the tool handles a private key (RUNNER_PRIVATE_KEY), this is necessary for its stated purpose, and the bundle includes significant guardrails and documentation to mitigate risk, with no evidence of malicious intent or data exfiltration.