zapper-api

Query DeFi portfolios, token holdings, NFTs, transactions, and prices via Zapper API. Supports 50+ chains. Use when user asks about wallet balances, DeFi positions, NFT collections, token prices, or transaction history.

This skill appears to be a straightforward Zapper API client. Before installing, confirm you trust the publisher (source is listed as unknown) and prefer exporting ZAPPER_API_KEY as an environment variable rather than storing it in ~/.config/zapper/addresses.json if you want to avoid keeping the key in plaintext. Review the shipped scripts locally (scripts/zapper.py) yourself to verify there are no hidden network calls beyond https://public.zapper.xyz/graphql. Use a limited or free-tier API key where possible, and rotate/revoke the key if you stop using the skill or if you spot unexpected behavior.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The OpenClaw AgentSkills skill bundle for Zapper API is benign. The `scripts/zapper.py` script correctly uses `urllib.request` to interact solely with the official Zapper GraphQL API endpoint (`https://public.zapper.xyz/graphql`). It retrieves the API key from the `ZAPPER_API_KEY` environment variable or a standard user configuration file (`~/.config/zapper/addresses.json`). There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The `SKILL.md` instructions are clear, align with the stated purpose, and do not contain any prompt injection attempts against the agent.