usd1 transfer

Securely transfer USD1 (USDC on Wormhole) between wallets via Wormhole Liquidity Facility on Testnet, returning transaction hash and status.

This skill appears to do what it says (transfer USD1 via Wormhole) but exercise caution before installing or running it with real funds: - Private key handling: the skill requires a raw privateKey input. Avoid pasting production private keys. Prefer a signing service, ephemeral/test keys, or hardware wallet integration rather than exposing raw keys to skills. - Test first: run only on testnet and with very small amounts until you verify behavior. SKILL.md says Testnet by default, but confirm runtime actually uses testnet endpoints in your environment. - Address format: double-check the recipient address encoding for the chosen chain (the code constructs a UniversalAddress with 'hex' which may be incorrect for some chains such as Solana). Sending to a malformed address can irreversibly lose funds. - Dependency/supply-chain risk: there is a package-lock with many npm dependencies (some with deprecation/security notes). Audit or vendor the dependencies and run dependency scanners before installing in sensitive environments. - Operational controls: restrict this skill to user-invoked use only (do not enable it to run autonomously), and review logs/outputs for unexpected network calls. If possible, require an explicit approval step before sending transactions. If you want, I can: (a) list the dependency warnings found in package-lock, (b) check the code for specific address-format fixes, or (c suggest a safer design that uses an external signer instead of raw private keys.

Type: OpenClaw Skill Name: usd1 Version: 1.0.0 The skill bundle is classified as benign. The `SKILL.md` clearly outlines the purpose of transferring USD1 (USDC on Wormhole) and explicitly marks the `privateKey` input as 'secure', reinforcing safe handling by the agent. The `index.js` code implements this functionality directly using the `@wormhole-foundation/sdk` and `@wormhole-foundation/sdk-base` libraries, operating on the 'Testnet' as specified. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent. Dependencies listed in `package-lock.json` are extensive but appear to be legitimate components of a multi-chain blockchain SDK.