📦 Passive Savings Crypto — 技能工具
v1.0.0Put idle USDC to work earning yield for you or your agent's wallet. Funds grow automatically and move like regular USDC when you're ready. No protocol intera...
0· 86·0 当前·0 累计
by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, required binaries, and env vars are consistent with its stated purpose (managing sUSDC on Linea); it needs a private key to sign transactions and uses npm dependencies — review contract addresses and token-approval behavior before use.
评估建议
This skill appears to do what it says: sign Linea transactions to mint/check/transfer sUSDC. Before installing or running it: (1) Only provide AGENT_PRIVATE_KEY to environments you fully control — it's the raw wallet private key and grants full custody. Prefer using a dedicated hot wallet with limited funds rather than your primary wallet. (2) Review and verify the hard-coded contract addresses (USDC, sUSDC, Locker Router) against official sources; if they are wrong or malicious, funds could be ...详细分析 ▾
ℹ 用途与能力
Name/description match the included scripts and tools: this is a CLI/skill for minting, checking, and transferring sUSDC on Linea. Minor wording mismatch: the description/README say "No protocol interactions," but the scripts call a Locker Router deposit and ERC20 approve/transfer functions (on-chain protocol interactions) — likely intended to mean "no manual multi-step protocol flow," not literally no on-chain calls.
✓ 指令范围
SKILL.md instructions map directly to the scripts (node scripts/*). At runtime the agent will read AGENT_PRIVATE_KEY and RPC_URL and call Linea RPC endpoints; the scripts do not read or transmit other local files or hidden endpoints. The skill prints links to autohodl.money/docs, but there is no evidence of outbound telemetry beyond RPC calls.
✓ 安装机制
Installation is npm install (package.json uses viem). This is a normal, expected install mechanism for a Node.js tool; dependencies come from the npm registry (package-lock.json present). No arbitrary downloads or extract-from-URL steps are used.
ℹ 凭证需求
Only AGENT_PRIVATE_KEY and RPC_URL are required, which is proportionate for a wallet-signing tool. Caveats: AGENT_PRIVATE_KEY is highly sensitive (provides full control of the wallet). The mint script requests infinite USDC approval for the Locker Router (maxUint256) — a common DeFi convenience but increases risk if the router contract or its keys are compromised. The default fallback RPC (https://linea.drpc.org) will be used if RPC_URL is unset — choose a trusted RPC provider.
✓ 持久化与权限
Skill is not always-included and does not modify other skills or system-wide settings. package.json offers an install-skill helper that copies SKILL.md into the user's Claude skills folder (reasonable for this ecosystem). Autonomous invocation is permitted (platform default) but not combined with other privilege escalations in this package.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/29
- Initial release of "passive-savings-crypto" skill. - Automatically earns yield on idle USDC in your (or your agent's) wallet via Linea mainnet. - All balances and payments move like regular USDC; no protocol interactions or extra steps required. - Provides CLI scripts for checking balances/earnings, depositing to earn yield, and transferring USDC. - Designed for simple integration into agents and automation workflows; works with Claude Code, OpenAI, and custom agents. - Emphasizes security (private key stays local) and on-chain-only operation.
● Pending
安装命令
点击复制官方npx clawhub@latest install passive-savings-crypto
镜像加速npx clawhub@latest install passive-savings-crypto --registry https://cn.longxiaskill.com