📦 Gekko Yield — USDC生息

v1.0.0

将USDC存入Moonwell Flagship USDC金库(Base链)赚取收益,支持一键存取、实时查看仓位/APY及生成收益报告。

1· 1.6k·0 当前·0 累计
sergey1997 头像by @sergey1997 (Serge)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/2/28
0
安全扫描
VirusTotal
无害
查看报告
OpenClaw
可疑
medium confidence
The skill's code mostly matches its DeFi purpose, but there are important inconsistencies and risky design choices (undeclared PRIVATE_KEY requirement and use of an external assembler API that returns executable transactions without strict on‑chain validation).
评估建议
This skill appears to implement the described Moonwell USDC vault actions, but exercise caution before installing or running it with real funds: - Private key handling: The scripts expect you to provide a PRIVATE_KEY environment variable, but the skill metadata does not declare this. Only run after you understand this and only use a dedicated hot wallet with limited funds. - External assembler risk: The compound flow asks Odos (https://api.odos.xyz) to assemble a ready-to-sign transaction and ...
详细分析 ▾
用途与能力
Name/description, CLI commands and included scripts all align with earning yield on Moonwell USDC on Base (deposit/withdraw/status/compound/report). However the skill metadata declares no required environment variables while the scripts expect a PRIVATE_KEY environment variable and write/read config/log files under ~/.config/gekko-yield. The missing declared env var is an incoherence that affects user consent and risk understanding.
指令范围
Runtime instructions and scripts do what they claim (interact with the vault, call Odos for swaps, query CoinGecko). But compound.ts calls the Odos 'assemble' endpoint which returns a ready-to-send transaction and the script sends it with walletClient.sendTransaction without validating that the assembled transaction targets only known, expected contracts (e.g., verifying assembled.transaction.to equals the expected Odos router). Relying on an external service to produce raw transactions for immediate signing and broadcast increases the blast radius if that external endpoint is compromised or malicious. The skill also instructs storing config/logs in the user's home directory and to put the private key in an env var — that is expected for on‑chain tooling but should be clearly declared in metadata (it is not).
安装机制
No binary install spec; scripts are Node/TypeScript and use standard npm/pnpm dependencies (viem, tsx). This is proportionate to the described functionality. Nothing is downloaded from an untrusted URL in the manifest.
凭证需求
The scripts require a wallet private key (PRIVATE_KEY) at runtime (and also read HOME for config/log paths), but the registry metadata lists no required environment variables or primary credential. Asking for a private key is expected for a wallet-managing DeFi tool, but it must be declared up front so users can make an informed risk decision; the omission is a significant coherence/consent issue.
持久化与权限
The skill is not always-enabled and does not request system-wide privileges. It writes its own config and logs under ~/.config/gekko-yield (normal for CLI tools). It does not modify other skills or global agent settings in the provided files.
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

无特殊依赖

版本

latestv1.0.02026/2/2

Initial release of gekko-yield v1.0.0: - Supply and withdraw USDC from the Moonwell Flagship USDC vault on Base chain - View position, vault APY, and wallet balances - Generate yield reports in Telegram/Discord, JSON, or plain text formats - Auto-compound WELL and MORPHO rewards back into the vault via Odos - Interactive setup and secure wallet configuration using environment variables - Clear security guidance and recommended wallet practices provided

无害

安装命令

点击复制
官方npx clawhub@latest install gekko-yield
镜像加速npx clawhub@latest install gekko-yield --registry https://cn.longxiaskill.com

技能文档

# Gekko Yield — 在 USDC 上赚取安全收益 通过在 Base 上的 Moonwell Flagship USDC vault 存入 USDC 来获取收益。 Vault: 0xc1256Ae5FF1cf2719D4937adb3bbCCab2E00A2Ca Chain: Base (8453) Asset: USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913) ## 为什么选择这个 Vault? Moonwell Flagship USDC vault 是 Base 上最安全的收益来源之一: - 为 Coinbase 提供流动性 — 为 Coinbase 的 BTC/ETH 借贷产品提供 2000 万美元以上流动性 - 仅接受蓝筹抵押品 — 贷款由 ETH、cbETH、wstETH、cbBTC 担保 - 保守的 LTV 比率 — 健康的抵押率要求 - 独立市场 — 风险被隔离 - 久经考验 — Morpho 的代码库不足 650 行,不可变且经过多轮审计 - 多层治理 — Moonwell DAO + Block Analitica/B.Protocol 策展人共同管理 ### 当前 APY(约 4–6%) | 组成部分 | APY | 来源 | |-----------|-----|--------| | 基础收益 | ~4–5% | 借款人利息 | | 奖励 | ~0.5–1% | 通过 Merkl 发放的 WELL + MORPHO | | 总计 | ~4.5–6% | 可持续,来自真实需求 | 收益来源于真实的借贷需求,而非不可持续的代币排放。 ## 快速开始 ``bash cd gekko-yield/scripts pnpm install # 或 npm install npx tsx setup.ts ` 设置向导将: 1. 引导你把私钥设为环境变量 2. 把配置保存到 ~/.config/gekko-yield/config.json ## 命令 ### 交互式设置 `bash npx tsx setup.ts ` 引导你完成钱包配置。 ### 查看仓位与 APY `bash npx tsx status.ts ` 返回:当前存款、vault 份额、APY、钱包余额、预估收益。 ### 生成报告 `bash # Telegram/Discord 格式(默认) npx tsx report.ts # JSON 格式(用于自动化) npx tsx report.ts --json # 纯文本 npx tsx report.ts --plain ` ### 存入 USDC `bash npx tsx deposit.ts # 示例:存入 100 USDC npx tsx deposit.ts 100 ` 将 USDC 存入 Moonwell vault,自动处理授权。 ### 取出 `bash # 取出指定数量的 USDC npx tsx withdraw.ts # 全部取出(赎回所有份额) npx tsx withdraw.ts all ` ### 自动复投 `bash npx tsx compound.ts ` 一站式命令: 1. 检查钱包中的奖励代币(WELL、MORPHO) 2. 通过 Odos 聚合器将其兑换为 USDC 3. 将 USDC 重新存入 vault ## 配置 配置文件位置:~/.config/gekko-yield/config.json `json { "wallet": { "source": "env", "envVar": "PRIVATE_KEY" }, "rpc": "https://mainnet.base.org" } ` ## 安全 ⚠️ 此 skill 管理真实资金,请仔细审阅: - 私钥在运行时从环境变量加载 - 脚本不会记录或落盘私钥 - 所有交易在执行前会先模拟 - 每次运行都会验证合约地址 - 脚本在发送前会展示交易预览 ### 推荐设置 1. 专用钱包 — 新建一个热钱包专供此 skill 使用 2. 限制资金量 — 只存入你能接受放在热钱包中的金额 3. 预留 gas — 在 Base 上保留少量 ETH 用于支付交易费 ## 错误处理 | 错误 | 原因 | 解决方法 | |-------|-------|-----| | USDC 不足 | 钱包内 USDC 不够 | 向 Base 桥接/转入更多 USDC | | Gas 不足 | 钱包内 ETH 不够支付交易 | 向 Base 钱包充值 ETH | | 钱包未配置 | 缺少配置 | 运行 npx tsx setup.ts | | PRIVATE_KEY 未设置 | 缺少环境变量 | 设置 $env:PRIVATE_KEY="your-key" | ## 依赖 脚本需要 Node.js 18+。首次运行前安装依赖: `bash cd scripts && pnpm install ` 所用包: - viem — 与 Ethereum 交互 - tsx` — 执行 TypeScript --- 由 Gekko AI 构建。由 ERC-8004 驱动。

数据来源ClawHub ↗ · 中文优化:龙虾技能库