Vincent - A secure wallet for your agent

Use this skill to safely create a wallet the agent can use for transfers, swaps, and any EVM chain transaction. Also supports raw signing and polymarket betting.

This skill appears to implement exactly what it says (a remote wallet API) but you should proceed cautiously: 1) Trust and provenance: the source/homepage are missing — verify who runs heyvincent.ai, review their security/privacy docs, code audits, and key handling policies before putting real funds behind it. 2) API key risk: the API key (Bearer token) grants financial authority — store it securely, limit its scope, and prefer short‑lived keys or revocation controls. The SKILL.md suggests storing keys at ~/.openclaw/credentials/agentwallet/… even though the registry lists no config paths; confirm where keys will be written and who/what can read them. 3) Autonomous actions: because the agent can invoke the skill autonomously, explicitly require interactive confirmation for any transfer/swap/sign operation or restrict the agent to read-only actions unless you approve transactions. 4) Least privilege: use this skill only with small test funds and tightly scoped spending policies until you have audited the service. 5) Ask the publisher for missing info that would raise confidence: source code or repo, security audit, API key scopes/permissions, how private keys are generated/rotated/revoked, data retention and telemetry, and exact policy controls available to limit agent actions.

Type: OpenClaw Skill Name: vincent-agent-wallet Version: 1.0.0 The skill bundle provides an AI agent with cryptocurrency wallet capabilities, emphasizing server-side private key management and user-defined spending policies. All network calls are directed to the legitimate service endpoint `https://heyvincent.ai`. The instructions for the agent to store and retrieve its own API keys in `~/.openclaw/credentials/agentwallet/<API_KEY_ID>.json` are for managing its operational credentials, not for exfiltrating unrelated sensitive data. The 're-link' mechanism, while sensitive, is a described recovery feature. There is no evidence of intentional harmful behavior, prompt injection to subvert the agent's core purpose, or attempts at data exfiltration beyond the skill's own operational data.