ZeroEx Swap

Execute token swaps using the 0x API with support for price quotes, gasless meta-transactions, and on-chain trade history retrieval.

This skill appears to do what it says, but it's handling real funds so proceed carefully: 1) Use a dedicated hot wallet with minimal funds and never use your main seed phrase. 2) Be aware the PRIVATE_KEY must be provided in environment variables — keep it secret and ephemeral; avoid long‑lived env variables on shared systems. 3) The code uses default third‑party RPC endpoints (e.g., llamarpc.com and mainnet.base.org); these providers will see your transactions and addresses — if privacy/trust is a concern, set RPC_URL to your own node or a trusted RPC. 4) Review the code before running; there are small implementation inconsistencies (e.g., swap.js accepts ZEROEX_PRIVATE_KEY but SKILL.md doesn't mention it, and quote.js references path/fileURLToPath without importing them) which are likely bugs rather than malicious. 5) Consider running in a sandboxed environment and test with tiny amounts first.

Type: OpenClaw Skill Name: zeroex-swap Version: 1.0.1 This skill is classified as suspicious due to its inherent high-risk capabilities, specifically requiring and directly handling a user's `PRIVATE_KEY` and `ZEROEX_API_KEY` to execute real cryptocurrency swaps. While the code (`swap.js`, `quote.js`) transparently implements the stated purpose of interacting with the 0x Swap API and includes some security best practices (e.g., exact allowance), the direct handling of a private key for real fund transactions represents a significant risk. The `SKILL.md` instructions guide the AI agent to perform these high-risk operations, which, while aligned with the skill's purpose, could lead to financial loss if misused or if the agent's environment is compromised.