📦 ATXSwapManage — ATXSwap管理
v0.0.2在 BSC 上支持 ATX：可创建钱包、查询价格及余额、执行 PancakeSwap V3 兑换、流动性操作，以及 BNB/ERC20 转账。当用户提到…
0· 18·0 当前·0 累计
by 下载技能包
最后更新
2026/4/20
安全扫描
OpenClaw
可疑
medium confidenceThe skill's purpose (on‑chain wallet and swap operations) is plausible, but there are several inconsistencies and risky behaviors (notably a script that prints private keys and a mismatch about whether BSC_RPC_URL is optional) that warrant caution before installing.
评估建议
This skill appears to be what it claims (an ATX wallet/trading tool for BSC) but has a few red flags you should consider before installing or invoking it automatically: 1) The bundle contains scripts that can export private keys (wallet.js export prints the private key to stdout). SKILL.md forbids showing exported keys, but the script will output them — do not let an agent paste that output into chat or transmit it anywhere. 2) SKILL.md requires a strict preview-and-confirm flow, but the scripts...详细分析 ▾
ℹ 用途与能力
Name/description align with the code and required binaries (node, npm) and the declared BSC RPC usage. However, registry metadata lists BSC_RPC_URL as a required env var while the SKILL.md explicitly states BSC_RPC_URL is optional (falls back to a public RPC). Also the skill uses a fixed keystore/secrets directory (~/.config/atxswap) which is plausible for a wallet skill but worth noting since it's not configurable in the SKILL.md.
⚠ 指令范围
SKILL.md imposes strict safety rules (never output private keys/passwords; always preview and ask confirmation before writes). Despite that, scripts include wallet.js export which prints the private key to stdout (console.log(pk)), and write operations in swap/transfer/liquidity execute immediately when their scripts are invoked. That creates a concrete risk: if an agent or user runs/export output without following the SKILL.md rules, secrets can be exposed and asset-moving transactions can be executed without enforced confirmation.
✓ 安装机制
There is no download-from-arbitrary-URL install; the package uses npm dependencies (atxswap-sdk and usual ecosystem packages) and no extract-from-URL steps. The code is included in the bundle, and npm install is required locally — this is a normal install pattern for a Node skill.
ℹ 凭证需求
Declared environment access is limited to BSC_RPC_URL (only this env var is listed). That is proportional to a blockchain client. Two caveats: (1) the metadata marks BSC_RPC_URL as required but SKILL.md says it is optional (inconsistent); (2) the skill reads/writes keystore and a secrets file under the user's home (~/.config/atxswap), and SKILL.md states the password is auto-saved — so the skill will create persistent, local secret storage. This is expected for wallet software but important to understand.
✓ 持久化与权限
always is false and the skill does not request permanent platform-wide privileges. It stores wallet keystore and secrets under its own fixed directory in the user's home, which is normal for a wallet tool. It does not modify other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSLinux · macOS
版本
latestv0.0.22026/4/20
Switch SDK dependency from github:agentswapx/atxswap-sdk to atxswap-sdk@^0.0.1 on npm. Cuts first-time install from ~1 min to ~16s.
● 无害
安装命令
点击复制官方npx clawhub@latest install atxswap
镜像加速npx clawhub@latest install atxswap --registry https://cn.longxiaskill.com