← 返回 Skills 市场
567
总下载
0
收藏
1
当前安装
1
版本数
在 OpenClaw 中安装
/install web3-data
功能描述
Explore Web3 on-chain data using Chainbase APIs. Use this skill when the user asks about blockchain data, token holders, wallet addresses, token prices, NFTs...
安全使用建议
This skill appears to do what it claims (query Chainbase) but has two practical transparency issues you should address before installing: (1) it reads CHAINBASE_API_KEY at runtime (defaulting to a public 'demo' key) even though the registry lists no required env vars — provide an API key only if you trust the skill and Chainbase, and expect rate limits with the demo key; (2) the included script requires curl and python3, but the metadata doesn't declare those binaries. Before installing, review scripts/chainbase.sh locally, confirm you have curl/python3 available, and decide whether to set CHAINBASE_API_KEY. If you want to be extra cautious, run the script in an isolated environment (container) and avoid supplying any sensitive keys you wouldn't give to a trusted integration.
功能分析
Type: OpenClaw Skill
Name: web3-data
Version: 1.0.0
The skill is classified as suspicious due to critical shell injection vulnerabilities in `scripts/chainbase.sh` and prompt injection risks in `SKILL.md`. The `scripts/chainbase.sh` script constructs `curl` commands by directly concatenating unquoted shell variables (`$call_url`, `$call_header`, `$API_KEY`, `$call_body`), making it vulnerable to arbitrary command execution if an attacker can inject shell metacharacters into the endpoint or parameter arguments. Furthermore, `SKILL.md` explicitly instructs the AI agent to construct SQL queries from user input and pass them via `--sql="..."` to this vulnerable script, which also embeds the SQL string into a JSON body without proper escaping, creating a potential SQL injection against the Chainbase API and exacerbating the shell injection risk.
能力评估
Purpose & Capability
The name/description, README, SKILL.md, and scripts consistently target Chainbase APIs and on-chain queries — capability aligns with purpose. However, the skill requires using an API key (CHAINBASE_API_KEY) and shell tooling (curl, python3) which the registry metadata does not declare, reducing transparency.
Instruction Scope
SKILL.md instructs the agent to route user intents to Chainbase endpoints, optionally run SQL queries, and call the included wrapper script or curl. Instructions do not ask for unrelated system files, other credentials, or to transmit data to unknown endpoints — all network calls point to Chainbase domains. SQL fallback can perform large queries (up to 100k rows), which is expected but may be costly.
Install Mechanism
There is no install spec (instruction-only), and the shipped script is executed directly. That keeps install risk low, but running the provided script will invoke curl and python3 and write nothing persistent. The repo contains no external downloads. Still, executing bundled scripts is an action with risk and should be reviewed locally before running.
Credentials
The runtime uses CHAINBASE_API_KEY (falls back to 'demo') but the skill metadata declares no required environment variables or primary credential. Additionally, the script depends on curl and python3 but the registry lists no required binaries. The missing declarations reduce transparency about secret access and runtime requirements.
Persistence & Privilege
The skill does not request persistent/global privileges and does not set always:true. The script does not modify other skills or agent configs. Autonomous invocation is allowed (platform default) but not combined with other high-risk flags here.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install web3-data - 安装完成后，直接呼叫该 Skill 的名称或使用
/web3-data触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial release of the web3-data skill.
- Enables exploration of on-chain Web3 data using Chainbase APIs.
- Supports queries for token holders, wallet addresses, token prices, NFTs, ENS domains, DeFi portfolios, and other blockchain analytics across multiple EVM chains.
- Provides clear endpoint selection and quick reference for common data lookups.
- Includes SQL API fallback for complex or custom blockchain data queries.
元数据
常见问题
web3-data-skill 是什么？
Explore Web3 on-chain data using Chainbase APIs. Use this skill when the user asks about blockchain data, token holders, wallet addresses, token prices, NFTs... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 567 次。
如何安装 web3-data-skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install web3-data」即可一键安装，无需额外配置。
web3-data-skill 是免费的吗？
是的，web3-data-skill 完全免费（开源免费），可自由下载、安装和使用。
web3-data-skill 支持哪些平台？
web3-data-skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 web3-data-skill？
由 lxcong（@lxcong）开发并维护，当前版本 v1.0.0。
推荐 Skills