安全扫描
OpenClaw
可疑
medium confidenceThe skill's commands match its stated purpose (monitoring public blockchain APIs), but the SKILL.md contains unexpected telemetry/registration URLs and minor inconsistencies around API key handling — these unexplained elements warrant caution.
评估建议
This skill mostly does what it says: example curl/jq queries of public blockchain APIs. But before installing or allowing autonomous use, consider: 1) Inspect and remove the trailing HTML comment that references onlyflies.buzz (unknown external hub/registration URLs). Treat that as a red flag — do not allow any code to call those endpoints. 2) Confirm how you will provide the Etherscan API key; the skill metadata should declare required env vars explicitly. 3) Because the source and homepage are...详细分析 ▾
✓ 用途与能力
The name/description align with the actual instructions: all runtime examples query public Hedera, Ethereum (Etherscan), and Solana endpoints to find large transfers. No unrelated binaries or credentials are requested in metadata.
⚠ 指令范围
Most instructions are limited to curl/jq calls against public blockchain APIs and are appropriately scoped. However: (1) the Etherscan example references an API key (YOUR_KEY) but the skill declares no required env vars — a minor documentation mismatch; (2) a hidden HTML comment at the end of SKILL.md contains external hub/registration/ping URLs (onlyflies.buzz) unrelated to the skill's purpose, which is unexpected and potentially a backchannel.
✓ 安装机制
Instruction-only skill with no install spec or code files; nothing is written to disk by an installer. This is the lowest-risk install model.
ℹ 凭证需求
The skill's metadata lists no required environment variables, but the Ethereum example explicitly needs an Etherscan API key. That key is reasonable for the described functionality but should be declared. No other credentials are requested — which is appropriate — but the undeclared API key and the unrelated comment URLs are inconsistent with the declared environment footprint.
⚠ 持久化与权限
The skill does not request always:true or altered agent privileges, which is fine. However, the commented OADP hub/agents/register/ping endpoints suggest potential external registration/telemetry (persistence-like behavior) if those URLs were used — this is unexpected and increases risk if activated.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/1
Whale Watch 1.0.0 — Initial Release - Monitor large crypto transactions across Hedera, Ethereum, and Solana using public APIs. - Track and alert on whale wallet activity and unusual transaction volumes. - Includes example command-line scripts for querying big transfers and monitoring specific wallets. - Tips provided for setup, API usage, and monitoring best practices.
● 无害
安装命令 点击复制
官方npx clawhub@latest install whale-watch
镜像加速npx clawhub@latest install whale-watch --registry https://cn.clawhub-mirror.com
技能文档
Track big money moves across blockchains using free public APIs.
Hedera Whale Detection
# Transactions over 10,000 HBAR in last hour
curl -s "https://mainnet-public.mirrornode.hedera.com/api/v1/transactions?type=cryptotransfer&limit=100&order=desc" | \
jq '[.transactions[] | select(.transfers[]?.amount > 1000000000000) | {id: .transaction_id, time: .consensus_timestamp, transfers: [.transfers[] | select(.amount > 1000000000000) | {account: .account, hbar: (.amount / 100000000)}]}] | .[:10]'
Track a Specific Wallet
WALLET="0.0.1234"
curl -s "https://mainnet-public.mirrornode.hedera.com/api/v1/transactions?account.id=$WALLET&limit=25&order=desc" | \
jq '.transactions[] | {time: .consensus_timestamp, type: .name, result: .result}'
Ethereum Whale Watch (Etherscan — needs free API key)
# Large ETH transfers (register at etherscan.io for free key)
curl -s "https://api.etherscan.io/api?module=account&action=txlist&address=WALLET&sort=desc&apikey=YOUR_KEY" | \
jq '.result[:10] | .[] | {hash: .hash[:16], value_eth: (.value | tonumber / 1e18), from: .from[:12], to: .to[:12]}'
Solana Large Transfers
# Recent signatures for a wallet
curl -s "https://api.mainnet-beta.solana.com" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"getSignaturesForAddress","params":["WALLET_ADDRESS",{"limit":10}]}' | \
jq '.result[] | {signature: .signature[:20], slot: .slot, time: .blockTime}'
Automated Monitoring
Add to your heartbeat for periodic whale checks:
## Whale Watch (every 2 hours)
curl -s "https://mainnet-public.mirrornode.hedera.com/api/v1/transactions?type=cryptotransfer&limit=50&order=desc" | \
jq '[.transactions[] | select(.transfers[]?.amount > 1000000000000)] | length'
# If > 0, investigate and alert
Tips
- Hedera Mirror Node is free, no auth, generous rate limits
- Etherscan free tier: 5 calls/sec, plenty for monitoring
- Solana RPC: public endpoints work but can be slow under load
- For real-time: consider WebSocket connections to RPC nodes
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制