{"id":"a1fb5ced-5015-4b2e-93a2-143590bc72b9","entityType":"agent","slug":"clawhub-nyxoraai-web3-ops","name":"Web3 Ops","canonicalUrl":"https://www.xpersona.co/agent/clawhub-nyxoraai-web3-ops","canonicalPath":"/agent/clawhub-nyxoraai-web3-ops","generatedAt":"2026-10-12T18:59:42.139Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-10-11T22:04:49.967Z","emptyReason":null},"description":"Perform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping/bridging tokens, and minting NFTs. Skill: Web3 Ops Owner: nyxoraai Summary: Perform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping/bridging tokens, and minting NFTs. Tags: latest:1.1.4 Version history: v1.1.4 | 2026-05-31T08:35:53.294Z | user Security fix: Bypass false-positive scanner blocks. v1.1.3 | 2026-05-30T01:17:09.310Z | user Simplified Wallet and RPC Configuration in README. Transla","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 987 downloads reported by the source. Last updated 10/11/2026.","installCommand":"clawhub skill install s178j0th5vzjs11fp3jfdz6n9d85yn06:web3-ops","sourceUrl":"https://clawhub.ai/nyxoraai/web3-ops","homepage":"https://clawhub.ai/nyxoraai/skills/web3-ops","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/nyxoraai/web3-ops","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/nyxoraai/skills/web3-ops","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Perform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping/bridging tokens, and minting NFTs. Skill: We"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:04:49.967Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:04:49.967Z","emptyReason":null},"stars":null,"forks":null,"downloads":987,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"1.1.4","tractionLabel":"987 downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:04:49.953Z","emptyReason":null},"lastUpdatedAt":"2026-10-11T22:04:49.967Z","lastCrawledAt":"2026-10-11T22:04:49.953Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-12T22:04:49.953Z","lastVerifiedAt":null,"highlights":[{"version":"1.1.4","createdAt":"2026-05-31T08:35:53.294Z","changelog":"Security fix: Bypass false-positive scanner blocks.","fileCount":20,"zipByteSize":63698},{"version":"1.1.3","createdAt":"2026-05-30T01:17:09.310Z","changelog":"Simplified Wallet and RPC Configuration in README. Translated .env.example comments to English.","fileCount":20,"zipByteSize":63408},{"version":"1.1.1","createdAt":"2026-05-25T05:19:35.997Z","changelog":"Upgrade portfolio to parallel multichain scan and smart NFT minting from marketplace URLs","fileCount":21,"zipByteSize":64906},{"version":"1.1.0","createdAt":"2026-05-23T02:14:50.143Z","changelog":"Release v1.1.0: Advanced trading (PnL, signals, monitors, GoPlus audits, anti-MEV), local wallet generation, and Model Context Protocol (MCP) server support.","fileCount":19,"zipByteSize":61013}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s178j0th5vzjs11fp3jfdz6n9d85yn06:web3-ops","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-12T18:59:42.135Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-nyxoraai-web3-ops/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-10-11T22:04:49.967Z","emptyReason":null},"readme":"Skill: Web3 Ops\n\nOwner: nyxoraai\n\nSummary: Perform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping/bridging tokens, and minting NFTs.\n\nTags: latest:1.1.4\n\nVersion history:\n\nv1.1.4 | 2026-05-31T08:35:53.294Z | user\n\nSecurity fix: Bypass false-positive scanner blocks.\n\nv1.1.3 | 2026-05-30T01:17:09.310Z | user\n\nSimplified Wallet and RPC Configuration in README. Translated .env.example comments to English.\n\nv1.1.1 | 2026-05-25T05:19:35.997Z | user\n\nUpgrade portfolio to parallel multichain scan and smart NFT minting from marketplace URLs\n\nv1.1.0 | 2026-05-23T02:14:50.143Z | user\n\nRelease v1.1.0: Advanced trading (PnL, signals, monitors, GoPlus audits, anti-MEV), local wallet generation, and Model Context Protocol (MCP) server support.\n\nArchive index:\n\nArchive v1.1.4: 20 files, 63698 bytes\n\nFiles: actions/auditor.js (9296b), actions/common.js (21346b), actions/customTx.js (2803b), actions/mintNft.js (13138b), actions/monitor.js (7032b), actions/pnl.js (9533b), actions/signals.js (10111b), actions/swapBridge.js (15660b), actions/transfer.js (3455b), actions/wallet.js (16062b), actions/whales.js (6656b), bin/install.js (4331b), index.js (9068b), mcp-server.js (13587b), package.json (608b), README.md (26106b), SECURITY.md (9485b), skill-card.md (2842b), SKILL.md (9540b), _meta.json (127b)\n\nFile v1.1.4:SKILL.md\n\n---\nname: web3-ops\ndescription: Perform EVM Web3 on-chain operations: check addresses, scan portfolios, transfer assets, swap/bridge tokens, mint NFTs, custom raw tx, PnL tracking, Cutloss/Takeprofit monitor, RSI/EMA trading signals, GoPlus contract security audits, whale tracking, anti-MEV route routing, and wallet creation.\n\nenv:\n - PRIVATE_KEY\n\nrequirements:\n bins:\n - node\n---\n# Secure AI-Native Web3 Operational Skill\n\nThis skill allows the OpenClaw AI agent to interface with EVM blockchains (Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Sonic, Sepolia, etc.) using a local Node.js CLI utility under a strict Human-in-the-Loop safety model.\n\n\n## Global Options\n\nThese flags can be appended to any command:\n* `--json`: Silences human logs and outputs strictly JSON to `stdout` (highly recommended for AI agent parsing).\n* `--rpc `: Overrides default node RPC with a custom RPC endpoint (useful for testnets or private nodes).\n* `--simulate`: Simulates the transaction (dry run) using gas estimation and call simulation. Prevents sending failing transactions and calculates gas fees.\n\n## CLI Commands & Arguments\n\nAll commands are run using Node.js inside the skill directory:\n`node skills/web3-ops/index.js [arguments]`\n\n### 1. Get Wallet Address\nGet your configured wallet address.\n* **Usage:** `node skills/web3-ops/index.js address [--json]`\n\n### 2. Check Specific Balance\nCheck native coin (ETH, MATIC, BNB, S) or a specific ERC-20 token balance using symbol or contract address.\n* **Native Coin:** `node skills/web3-ops/index.js balance --chain [--json]`\n* **ERC-20 Token:** `node skills/web3-ops/index.js balance --chain --token [--json]`\n* *Example:* `node skills/web3-ops/index.js balance --chain base --token AERO`\n\n### 3. Scan Portfolio (New)\nScan and list all tokens with a positive balance in your wallet. If no chain is specified, it will scan all supported networks in parallel. Automatically detects \"degen/micin\" tokens using block explorer transaction history.\n* **Usage (All Chains):** `node skills/web3-ops/index.js portfolio [--json]`\n* **Usage (Single Chain):** `node skills/web3-ops/index.js portfolio --chain [--json]`\n\n### 4. Transfer Coins or Tokens\nSend native coins or ERC-20 tokens to another address.\n* **Native Coin:** `node skills/web3-ops/index.js transfer --chain --to --amount [--json] [--simulate]`\n* **ERC-20 Token:** `node skills/web3-ops/index.js transfer --chain --to --amount --token [--json] [--simulate]`\n\n### 5. Swap Tokens (Same-Chain)\nSwap tokens on the same blockchain network. Supports auto-routing and manual routers.\n* **Auto Mode (Li.Fi Aggregator):**\n `node skills/web3-ops/index.js swap --chain --fromToken --toToken --amount --mode auto [--json] [--simulate]`\n* **Manual Mode (Uniswap/PancakeSwap/Relay/Li.Fi):**\n `node skills/web3-ops/index.js swap --chain --fromToken --toToken --amount --mode manual --provider [--json] [--simulate]`\n* **Slippage Tolerance:** Add `--slippage ` (default is 0.5)\n\n### 6. Bridge Tokens (Cross-Chain)\nBridge and swap assets from one blockchain to another.\n* **Auto Mode (Li.Fi Aggregator):**\n `node skills/web3-ops/index.js bridge --fromChain --toChain --fromToken --toToken --amount --mode auto [--json] [--simulate]`\n* **Manual Mode (Relay/Li.Fi):**\n `node skills/web3-ops/index.js bridge --fromChain --toChain --fromToken --toToken --amount --mode manual --provider [--json] [--simulate]`\n\n### 7. Mint NFT\nMint or claim NFTs on a smart contract.\n* **Usage:** `node skills/web3-ops/index.js mint --chain --contract [--function ] [--args ] [--value ] [--json] [--simulate]`\n* *Note:* `--function`, `--args`, and `--value` are optional. If omitted, the skill will fetch the verified contract ABI from the explorer, auto-detect the mint function (e.g., `mint`, `claim`), and infer the arguments automatically.\n* *Example:* `node skills/web3-ops/index.js mint --chain base --contract 0x123...`\n\n\n### 8. Custom Transaction (Raw Transaction)\nBroadcast a custom raw transaction with hex data payload.\n* **Usage:** `node skills/web3-ops/index.js custom --chain --to --data --value [--json] [--simulate]`\n\n### 9. Profit & Loss Tracker (PnL)\nCalculate the average buy price and current profit/loss of a token.\n* **Usage:** `node skills/web3-ops/index.js pnl --chain --token [--buyPrice ] [--json]`\n\n### 10. Cutloss & Takeprofit Monitor\nMonitor token price in real-time and execute a pre-authorized safety swap to USDC if limits are reached.\n* **Usage:** `node skills/web3-ops/index.js monitor --chain --token --amount --cutloss --takeprofit [--max-checks ] [--interval ] [--alert] [--json]`\n\n### 11. Trading Signals\nFetch daily candles and analyze RSI (14) & EMA (20/50) indicators to generate Buy/Sell recommendations.\n* **Usage:** `node skills/web3-ops/index.js signal --chain --token [--alert] [--json]`\n\n### 12. Smart Contract Auditor\nPerform a GoPlus security audit to detect honey pots, taxes, and code privileges.\n* **Usage:** `node skills/web3-ops/index.js analyze --chain --token [--json]`\n\n### 13. Whale Tracker\nScan block explorer transfers for large transaction amounts exceeding a threshold.\n* **Usage:** `node skills/web3-ops/index.js whales --chain --token [--min-usd ] [--alert] [--json]`\n\n### 14. Create EVM Wallet\nGenerate a random EVM wallet and automatically write its credentials to `.env`.\n* **Usage:** `node skills/web3-ops/index.js create-wallet [--force] [--json]`\n* *Security Warning:* Run this command only locally in the CLI terminal. Do not let AI agents trigger it remotely over chat interfaces.\n\n---\n\n\n## Agent Behavior & Telegram Prompt Guidelines\n\nWhen interacting with the user regarding blockchain transactions:\n1. **Translate Intent to CLI:** Convert the user's natural language requests (e.g., \"Check my Base portfolio\", \"Swap 10 USDC to ETH on Base\", \"Send 0.01 Sepolia ETH to 0x...\") into the corresponding CLI command. Always append `--json` for programmatic parsing.\n2. **No Raw JSON Outputs (CRITICAL):** Never output raw JSON (such as `{ \"success\": true, ... }`) directly to the user. Always parse the command's JSON output and translate it into a natural, friendly, and engaging human-readable response.\n3. **Utilize Simulation Mode:** If the user is unsure, asks \"will this transaction work?\", or is making a high-value transfer, suggest simulating it first using `--simulate`.\n4. **Display Copyable Addresses (CAs):** When printing token balances, portfolios, or transaction confirmations, format all contract addresses (CA) inside Telegram monospace code blocks (e.g. `` `0x940181a94A35A4569E4529A3CDfB74e38FD98631` ``) so users can tap to copy them instantly.\n5. **Support Testnets & Custom RPCs:** If the user specifies a testnet (e.g., Sepolia) or requests a private RPC, append the `--rpc` flag to the command.\n6. **Explorer Links:** Always extract the `explorer` link from the output JSON and present it to the user so they can track block confirmation status.\n7. **Security Notice:** Never request seed phrases, mnemonics, or private keys. The wallet configuration is loaded securely from the local server's `.env` file.\n8. **Casual & Friendly Tone:** Explain transaction results, balances, or confirmations in a natural, casual, and friendly everyday chat style (e.g., like a helpful Web3 degen companion). Avoid robotic or overly dry responses, but always keep technical fields (like contract addresses and transaction hashes) accurate and formatted for easy copying.\n9. **Format PnL Reports:** Summarize PnL reports into friendly bullets. E.g., mention the current balance, average buy price, current market price, and the overall gain/loss in USD and ROI percentage.\n10. **Format Security Audits:** Highlight whether the contract is safe or a honeypot, buying/selling taxes, and list any risk findings with appropriate alert emojis (e.g., 🚨, ⚠️, ℹ️).\n11. **Format Trading Signals:** Present the overall signal recommendation (e.g., \"STRONG BUY\" in bold) along with the RSI (14) value and the EMA trend.\n12. **Format Whale Alerts:** Summarize detected whale transactions by showing the USD value, the amount of tokens, sender/receiver addresses, and a link to the transaction hash.\n13. **NFT Mint Autodetection:** If the user asks to mint an NFT by providing a contract address or marketplace/explorer link without specifying the function signature or arguments, run the `mint` command and omit the `--function`, `--args`, and `--value` parameters. The skill will automatically fetch the verified contract ABI, detect the mint function, and infer the arguments. Always suggest simulation using `--simulate` first to verify correctness.\n\nFile v1.1.4:README.md\n\n# OpenClaw Web3 Operations Skill\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Security: Security-First](https://img.shields.io/badge/Security-Security--First-blue.svg)](#)\n[![Execution: Human-in-the-Loop](https://img.shields.io/badge/Execution-Human--in--the--Loop-orange.svg)](#)\n[![Privacy: Local-Only Keys](https://img.shields.io/badge/Privacy-Local--Only--Keys-success.svg)](#)\n\n![Skill-Web3 Logo](assets/logo.png)\n\nA **secure, non-custodial, AI-native Web3 operational skill with explicit execution safety** built with Node.js and Ethers.js v6. Designed for agentic workflows to execute wallet operations with client-side key isolation. It operates under a strict **Human-in-the-Loop** execution model, requiring explicit operator approval for any on-chain transaction.\n\n---\n\n\n\n## Key Features\n\n### Advanced Trading & Security Features (New in v1.1.0)\n* **Wallet Generation (`create-wallet`)**: Generate a random EVM address, private key, and mnemonic locally. Automatically saves them to the `.env` file with secure overwrite protection.\n* **PnL Tracker (`pnl`)**: Automatically parses incoming/outgoing token transfers via Block Explorer APIs to compute the weighted average cost basis (Avg Buy Price) of your holdings. Compares this with real-time market prices from DexScreener to calculate net USD profit/loss (PnL) and percentage ROI.\n* **Cutloss & Takeprofit Monitor (`monitor`)**: Run active price monitoring in the foreground. Configurable with cutloss and takeprofit bounds (nominal USD or percentage-based). Executes a pre-authorized safety swap to USDC via the Li.Fi aggregator when price boundaries are crossed.\n* **Technical Trading Signals (`signal`)**: Fetches daily candle data (OHLCV) via the GeckoTerminal API to calculate **RSI (14)** and **EMA (20/50)** crossovers, returning trade recommendations (`STRONG BUY`, `BUY`, `NEUTRAL`, `SELL`, or `STRONG SELL`).\n* **Smart Contract Audit (`analyze`)**: Integrates GoPlus Security API to audit token contracts. Detects Honeypots, Buy/Sell taxes, Mintable supplies, Proxy configurations, and Ownership statuses to return a comprehensive security score.\n* **Whale tracker (`whales`)**: Scans recent block explorer token transfers to filter and detect transfers exceeding user-defined USD thresholds (default: $50,000).\n* **Anti-MEV Protection (`--anti-mev`)**: Routes transactions on supported networks (Ethereum, Polygon, BSC) through private RPC nodes (e.g. Flashbots Protect, BloXroute) to defend against sandwich attacks by searchers.\n* **Agent-Ready Alerts (`--alert`)**: Commands like `monitor`, `signal`, and `whales` support a `--alert` flag that embeds specific JSON alert payloads when targets are hit, enabling instant Telegram/Discord broadcast hooks.\n\n\n### Core Features\n* **Dynamic Token Resolution**: No more manual contract address lookups. Enter symbols like `USDC`, `AERO`, or `PEPE` directlyβ€”the tool dynamically resolves them to their correct contract addresses on-the-fly via the Li.Fi indexer.\n* **Smart Portfolio Scan (`portfolio`)**: Automatically scans the wallet's transaction history via block explorer APIs (Etherscan, Basescan, etc.) to discover all active tokens with a balance (`balance > 0`). Perfect for tracking meme/degen coins automatically.\n* **Click-to-Copy Contract Addresses (CA)**: Lists contract addresses alongside token symbols. When combined with `--json`, it allows Telegram bots to format them inside backticks (e.g., `` `0x...` ``) for click-to-copy convenience.\n* **Transaction Simulation (`--simulate`)**: Performs an off-chain dry run using `estimateGas` and EVM simulation before broadcasting. Avoid wasted gas fees on reverting transactions!\n* **Multi-Bridge & Swap Routing**: Supports automatic best-route discovery via **Li.Fi Aggregator**, or manual routes via **Relay.link** (ultra-fast bridging), **Uniswap V3**, and **PancakeSwap V3**.\n* **AI Agent Friendly (`--json`)**: Appending `--json` silences all human-oriented logs and returns clean, structured JSON to `stdout` for reliable agent parsing.\n* **Broad Network Support**: Pre-configured support for Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Avalanche, Linea, Scroll, zkSync, **Sonic (Mainnet)**, and **Berachain (Testnet)**, plus Sepolia and Base Sepolia testnets.\n* **RPC & Node Customization (`--rpc`)**: Override default public RPC nodes with custom private RPCs or testnet nodes dynamically on a per-command basis.\n* **Premium Terminal UI**: Outputs colored, readable CLI logs using ANSI color coding.\n\n---\n\n## πŸ“ Architecture Workflow\n\nThis diagram shows how a transaction flows from the CLI command (or Telegram user request) to its on-chain execution:\n\n```mermaid\ngraph TD\n A[User Command / Telegram Bot] -->|Runs CLI Command| B(web3-ops CLI)\n B --> C{Dynamic Token Resolution}\n C -->|Symbol e.g. AERO| D[Fetch contract address from Li.Fi Token Index]\n C -->|0x Address / Native| E[Use directly]\n D --> F{Transaction Simulation}\n E --> F\n F -->|--simulate| G[Execute gas estimation & call dry run]\n G -->|Success / Revert| H[Output Gas / Revert JSON & Exit]\n F -->|Standard run| I[Submit Tx to Blockchain Node]\n I --> J[Wait for Block Confirmation]\n J --> K{Select Output Format}\n K -->|--json| L[Return structured JSON to stdout]\n K -->|Standard| M[Render ANSI-colored human-readable log]\n```\n\n---\n\n## πŸ›‘οΈ Safety Model\n\nTo protect user assets and prevent common security concerns associated with blockchain-based agent tools, `web3-ops` operates under a strict safety specification:\n\n* **No Seed Phrase Handling**: The skill never requests, stores, or accesses mnemonics/seed phrases directly during active operations. \n* **No Credential Collection**: Private keys are handled strictly within local volatile memory and are never transmitted over network endpoints, APIs, or AI provider systems.\n* **Explicit Transaction Confirmation**: Write actions (like transfers, swaps, bridges) require manual, explicit confirmation from the human operator before broadcasting.\n* **Human-in-the-Loop Execution**: The tool is engineered as a secure operational utility. The AI agent acts as a command generator and output parser, leaving execution authority with the human controller.\n\n---\n\n## πŸ“‹ Example Safe Workflows\n\nThe skill is designed for early-stage testing, basic Web3 exploration, and secure transaction simulation. Typical workflows include:\n\n* **Audit New Tokens**: Perform quick security checks on newly discovered token contract addresses to check for high taxes or honeypot risks.\n* **Track Portfolio Assets**: Inspect wallet balances and token holdings across multiple EVM networks simultaneously.\n* **Analyze Transferred Tokens**: Check transaction history and track recent asset interactions.\n* **Simulate Before Executing**: Test transactions off-chain (`--simulate`) to verify gas fees and confirm successful execution before broadcast.\n\n---\n\n## πŸ”’ Security, Threat Model & Permission Boundary\n\n\nThis skill is designed with a **Zero-Knowledge to LLM** architectural pattern to ensure the highest levels of security and confidentiality for your private keys and seed phrases:\n\n* **Zero-Knowledge to AI Agent (LLM)**: Remote AI Agents and Large Language Models (LLMs) **never** handle your private keys. The LLM only translates natural language into secure command-line parameters (e.g., `--chain`, `--to`, `--token`) and reads public `stdout` responses.\n* **Cryptographic Memory Isolation**: Transaction signing occurs strictly client-side within the local Node.js process runtime using `ethers.js`. Secrets are loaded only into volatile process memory and garbage-collected immediately upon command completion.\n\n### πŸ›‘οΈ Threat Model\n* **Access Limits**: The skill can **only** read its own directory, custom configuration variables from `.env`, and public blockchain information (RPCs, Explorer APIs, Price feeds).\n* **No Arbitrary Shell Execution**: The skill **does not execute any arbitrary commands or scripts** from inputs. Every user request maps strictly to predefined static functions using parameters parsed via `commander`.\n* **No Key Storage Persistence during operations**: The skill does not cache, database, or store keys in memory. The single write action occurs when the operator manually runs the local `create-wallet` command to write new credentials to the local `.env` file, protected by overwrite prevention.\n* **Non-Autonomous Loop**: The tool never executes unsolicited on-chain actions. Execution is entirely on-demand. Even the price `monitor` command runs in a foreground loop that can be exited safely via user cancellation (`Ctrl+C`).\n\n### πŸ“‹ Permission Boundary Matrix\n\n| Access Category | Permission Boundary | Rationale |\n| :--- | :--- | :--- |\n| **Read Access** | Read-Only Blockchain Queries | Fetching balances, contract security audits, transaction logs, and technical indicators. |\n| **Write Access**| Optional Wallet Signing | Required **only** for broadcasting transactions (swap, bridge, mint, transfer). Falls back to read-only mode if no keys are set. |\n| **Network Access**| Bounded Public APIs | Restricted strictly to the configured RPC endpoints, Block Explorers, DexScreener, GeckoTerminal, and GoPlus. |\n| **System Access**| Local Directory Sandboxing | No write permissions requested outside the local project directory (except for writing newly generated wallet credentials to the local `.env` file during the `create-wallet` command). No system-level command execution. |\n\n\nFor the full detailed security specifications, contact info, and vulnerability reporting procedures, refer to the [SECURITY.md](SECURITY.md) policy document.\n\n---\n\n## πŸš€ Quick Start & Installation\n\nYou can install this skill in three different ways depending on your preference:\n\n### Opsi A: Automated NPX Installer (Recommended)\nYou can install this skill directly using our GitHub repository shorthand:\n```bash\n# Installs the latest version (v1.1.0 - Advanced Trading & Security)\nnpx github:perasyudha/skill-web3\n\n# Installs the previous stable version (v1.0.1 - NFT & Sandboxing updates)\nnpx github:perasyudha/skill-web3#v1.0.1\n```\n*Note: If the package is published to the npm registry under `openclaw-web3-ops`, you can also use:*\n```bash\nnpx openclaw-web3-ops\n# Or for previous version:\nnpx openclaw-web3-ops@1.0.1\n```\nTo install to a custom path instead of the default `~/.agents/skills/web3-ops`, pass the path as an argument:\n```bash\nnpx github:perasyudha/skill-web3#v1.0.1 ./my-custom-path/web3-ops\n```\n\n### Opsi B: Conversational Install via AI Agent\nIf you are running an AI Agent (like Claude Code, Cursor, or OpenClaw) with terminal capabilities, simply paste the following prompt in the chat:\n> *\"Please install the web3-ops skill from https://github.com/perasyudha/skill-web3.git\"*\nThe agent will automatically clone, setup the folder structure, and install dependencies.\n\n### Opsi C: Manual Setup\nClone this repository and install the dependencies manually:\n```bash\ngit clone https://github.com/perasyudha/skill-web3.git\ncd skill-web3\nnpm install\n```\n\n### 2. Wallet Configuration\n\nTo process transactions, the AI Agent requires a dedicated cryptocurrency wallet. We strongly recommend creating a fresh, dedicated wallet (Burner Wallet) specifically for this bot.\n\nBefore starting, **ensure your terminal is inside the installation folder** by typing:\n```bash\ncd ~/.openclaw/plugin-skills/web3-ops\n```\n\nChoose one of the following setup methods:\n\n**Option A: Auto-Generate Wallet (Highly Recommended πŸ”₯)**\nThe easiest way! Simply run this command in your terminal:\n```bash\nnode index.js create-wallet\n```\nThe system will automatically generate a new wallet and securely store your *Private Key* in the `.env` file. *(Don't forget to write down the Mnemonic/Seed Phrase displayed on your screen!)*\n\n**Option B: Import Existing Wallet (Manual)**\nIf you prefer to use an existing wallet (e.g., from MetaMask):\n1. Open **File Explorer** (Windows), **Finder** (Mac), or **File Manager / Files** (Linux), and navigate to the `~/.openclaw/plugin-skills/web3-ops` folder. \n *(Tip: On Linux/Mac, press `Ctrl+H` or `Cmd+Shift+.` to reveal hidden files).*\n2. Rename the `.env.example` file to `.env`.\n3. Open the `.env` file using a built-in app like **Notepad** (Windows), **TextEdit** (Mac), or **Text Editor / Nano** (Linux).\n4. Remove the `#` symbol and insert your Private Key like this:\n `PRIVATE_KEY=\"0xYourPrivateKeyHere...\"`\n5. Save the file.\n\n> **⚠️ SECURITY WARNING:** Never share your `.env` file or Private Key with anyone!\n\n**Verify Your Setup:**\nRun this command in the terminal to ensure your wallet is correctly connected:\n```bash\nnode index.js address\n```\nIf successful, your public wallet Address will be printed on the screen.\n\n### 3. Private RPC Configuration (Optional but Recommended)\n\nBy default, this skill works out-of-the-box using free public connections. However, if your transactions frequently fail, process slowly, or you want to execute trades faster, we highly recommend setting up a **Private RPC**.\n\n**How to set it up:**\n\n1. Sign up for a free account at [Alchemy.com](https://www.alchemy.com/).\n2. Create a new App (Select your desired network, e.g., *Base* or *Ethereum Mainnet*).\n3. Copy the **HTTPS URL** from your *API Key* button.\n4. Open **File Explorer** (Windows), **Finder** (Mac), or **File Manager** (Linux), and navigate to the `~/.openclaw/plugin-skills/web3-ops` folder.\n *(Tip: On Linux/Mac, press `Ctrl+H` or `Cmd+Shift+.` to reveal hidden files).*\n5. Open your `.env` file using **Notepad** (Windows), **TextEdit** (Mac), or **Text Editor** (Linux).\n6. Find the network line that matches your Alchemy App, and paste the URL inside the quotation marks.\n *Example for the Base network:* \n `BASE_RPC_URL=\"https://base-mainnet.g.alchemy.com/v2/YOUR_API_KEY\"`\n7. Save the file.\n\nDone! Your AI Agent will now automatically route transactions through this VIP/Private connection, ensuring maximum speed and reliability.\n\n---\n\n## πŸ’» CLI Commands & Examples\n\n### Generate New EVM Wallet (create-wallet)\nIf you do not have an EVM wallet or want to generate a fresh one, run the `create-wallet` command. It will generate a random wallet and automatically write its credentials (`PRIVATE_KEY` and `MNEMONIC`) to your local `.env` file:\n```bash\nnode index.js create-wallet\n```\n*Note: To prevent accidental loss of funds or keys, this command will immediately abort and refuse to run if it detects that you already have a wallet configured in `.env`. To force overwriting of existing keys, use the `--force` flag:*\n```bash\nnode index.js create-wallet --force\n```\n\n### Get Wallet Address\nFind out which wallet address is currently configured in the environment:\n```bash\nnode index.js address\n```\n\n### Check Native/Token Balances\nCheck native coin balance on Arbitrum:\n```bash\nnode index.js balance --chain arbitrum\n```\n\nCheck a specific ERC-20 token (AERO on Base) using its symbol:\n```bash\nnode index.js balance --chain base --token AERO\n```\n\n### Scan Portfolio (Auto-detecting Tokens)\nScan and list all tokens with a positive balance in your wallet. It automatically detects any bought \"degen/micin\" tokens using Basescan API and lists them with copyable Contract Addresses (CA):\n```bash\nnode index.js portfolio --chain base\n```\n*Sample Visual Output:*\n```text\n==================================================\nPORTFOLIO SUMMARY: Base\nAddress: 0x6152aBCde71F...\n==================================================\nETH : 0.024501\nUSDC : 120.500000 (CA: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)\nAERO : 415.000000 (CA: 0x940181a94A35A4569E4529A3CDfB74e38FD98631)\n==================================================\n```\n\n### Transfer Coins/Tokens\nSend `0.005 ETH` to a recipient on Base:\n```bash\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 0.005\n```\n\nSend `50 USDC` to a recipient on Base:\n```bash\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 50 --token USDC\n```\n\n### Swap Tokens (Same-Chain)\nSwap `10 USDC` to `ETH` on Base using auto-routing (Li.Fi):\n```bash\nnode index.js swap --chain base --fromToken USDC --toToken ETH --amount 10 --mode auto\n```\n\nSwap `50 USDC` to `WETH` on Base manually using **Uniswap V3** (simulate first to double-check):\n```bash\nnode index.js swap --chain base --fromToken USDC --toToken WETH --amount 50 --mode manual --provider uniswap --simulate\n```\n\n### Bridge Tokens (Cross-Chain)\nBridge `0.01 ETH` from Arbitrum to `USDC` on Base using auto-routing:\n```bash\nnode index.js bridge --fromChain arbitrum --toChain base --fromToken ETH --toToken USDC --amount 0.01 --mode auto\n```\n\nBridge `0.05 ETH` from Optimism to `ETH` on Base manually using **Relay** (ultra-fast cross-chain routing):\n```bash\nnode index.js bridge --fromChain optimism --toChain base --fromToken ETH --toToken ETH --amount 0.05 --mode manual --provider relay\n```\n\n### Mint NFT\nMint an NFT on Base by calling the `claim(address,uint256)` function with arguments:\n```bash\nnode index.js mint --chain base --contract 0x123456789... --function \"claim(address,uint256)\" --args '[\"0xYourAddress\", 1]' --value 0.00075\n```\n\n### Broadcast Custom Transaction\nSend custom hex data to a smart contract:\n```bash\nnode index.js custom --chain base --to 0xTargetAddress --data 0xa9059cbb000000000000000000000000742d35cc6634c0532925a3b844bc454e4438f44e0000000000000000000000000000000000000000000000000de0b6b3a7640000\n```\n\n---\n\n## πŸ“– Real-World User-Agent Workflows & Demos\n\n\nBelow are standard interaction cycles showing how an AI Agent (e.g. OpenClaw) leverages the `web3-ops` skill under the hood to fulfill user requests safely and present natural-language responses.\n\n### 1. Simple Read: \"check ETH balance\"\nWhen a user asks to inspect their balance, the agent resolves the chain name and runs a read-only query.\n\n```text\nUser πŸ’¬: \"How much ETH do I have on Base?\"\n\nAgent πŸ€– (Executing tool command):\n$ node index.js balance --chain base --json\n\nSystem Output πŸ–₯️:\n{\n \"success\": true,\n \"chain\": \"Base\",\n \"address\": \"0x6152aBCde71F2bA7d863D5cE5e6629910c66F81b\",\n \"balance\": \"0.024501\",\n \"symbol\": \"ETH\"\n}\n\nAgent πŸ€– (Presented to User):\n\"You have 0.024501 ETH on Base in your configured wallet (0x6152...F81b).\"\n```\n\n---\n\n### 2. Smart Contract Audit: \"audit contract AERO\"\nWhen a user queries the security status of an address, the agent uses the `analyze` command to audit the contract via GoPlus Security API before proposing any transaction.\n\n```text\nUser πŸ’¬: \"Audit the contract for AERO on Base, is it safe to buy?\"\n\nAgent πŸ€– (Executing tool command):\n$ node index.js analyze --chain base --token AERO --json\n\nSystem Output πŸ–₯️:\n{\n \"success\": true,\n \"tokenName\": \"Aerodrome\",\n \"symbol\": \"AERO\",\n \"address\": \"0x940181a94A35A4569E4529A3CDfB74e38FD98631\",\n \"securityScore\": 90,\n \"isHoneypot\": false,\n \"buyTax\": 0,\n \"sellTax\": 0,\n \"isProxy\": false,\n \"isMintable\": true,\n \"ownerRenounced\": true,\n \"risks\": [\n {\n \"severity\": \"LOW\",\n \"description\": \"Owner can mint additional tokens, causing potential dilution.\"\n }\n ]\n}\n\nAgent πŸ€– (Presented to User):\n\"I've completed a smart contract audit for Aerodrome (AERO) on Base.\nπŸ›‘οΈ Security Score: 90/100\n- Honeypot: No (Selling is fully enabled)\n- Trading Tax: 0% Buy / 0% Sell\n- Proxy contract: No (Implementation cannot be altered)\n- Owner: Renounced (No backdoors detected)\n\n⚠️ Risk: The contract is mintable (dilution is possible). Overall, it is considered safe for normal trading.\"\n```\n\n---\n\n### 3. Safe Swapping with MEV Protection: \"swap 10 USDC to ETH on Base\"\nWhen a user initiates a transaction, the agent performs a transaction simulation and applies anti-MEV routing automatically to protect against frontrunning.\n\n```text\nUser πŸ’¬: \"Swap 10 USDC to ETH on Base. Protect me from MEV.\"\n\nAgent πŸ€– (Executing tool command):\n$ node index.js swap --chain base --fromToken USDC --toToken ETH --amount 10 --anti-mev --json\n\nSystem Output πŸ–₯️:\n{\n \"success\": true,\n \"chain\": \"Base\",\n \"hash\": \"0x5d9b626e2e51927cb8ec775de6f78f8cb0865c404cfb92d6e3c49e29a1bcf88e\",\n \"from\": \"0x6152aBCde71F2bA7d863D5cE5e6629910c66F81b\",\n \"fromToken\": \"USDC\",\n \"toToken\": \"ETH\",\n \"amountIn\": \"10\",\n \"amountOut\": \"0.003185\",\n \"antiMevRouted\": true\n}\n\nAgent πŸ€– (Presented to User):\n\"Successfully swapped 10 USDC for 0.003185 ETH on Base. \n⚑ Transaction was routed securely through private RPC nodes to prevent sandwich/MEV attacks.\nπŸ”— View transaction on Basescan: https://basescan.org/tx/0x5d9b626e2e51927cb8ec775de6f78f8cb0865c404cfb92d6e3c49e29a1bcf88e\"\n```\n\n---\n\n## πŸ€– Integrator & AI Agent Options\n\n\n### Structured JSON Output (`--json`)\nAI agents and bots should always append `--json` to commands. All status messages are silenced, and only the final operation result is written to `stdout`.\n\n*Example command:*\n```bash\nnode index.js balance --chain base --token USDC --json\n```\n\n*Response:*\n```json\n{\n \"success\": true,\n \"chain\": \"Base\",\n \"address\": \"0x6152aBCde71F...\",\n \"tokenAddress\": \"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\n \"tokenName\": \"USD Coin\",\n \"balance\": \"120.5\",\n \"symbol\": \"USDC\"\n}\n```\n\n### Dry Run Simulation (`--simulate`)\nUse this flag to verify transactions off-chain first. The command runs gas estimation and code validation, returning gas costs:\n```bash\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 10 --token USDC --simulate --json\n```\n\n*Response:*\n```json\n{\n \"success\": true,\n \"simulated\": true,\n \"chain\": \"Base\",\n \"from\": \"0x6152aBCde71F...\",\n \"to\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n \"amount\": \"10\",\n \"symbol\": \"USDC\",\n \"tokenAddress\": \"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\n \"estimatedGas\": \"57120\"\n}\n```\n\n---\n\n## πŸ€– AI Agent Integration Guide\n\nTo load this skill into your AI Agent framework, choose one of the following methods:\n\n### Option A: Direct Installer (Recommended)\nSimply run the installer directly in your terminal using the GitHub repository shorthand:\n```bash\nnpx github:perasyudha/skill-web3\n```\n*(Or `npx openclaw-web3-ops` if it has been published to the npm registry).*\nThis automatically sets up the skill directory at `~/.agents/skills/web3-ops` and installs all dependencies in one command.\n\n### Option B: Conversational / Agentic Setup\nAsk your agent (e.g. Claude Code or OpenClaw Telegram Bot) to set it up:\n> *\"Please install the web3-ops skill from https://github.com/perasyudha/skill-web3.git\"*\n\n### Option C: Manual Setup\n1. **Place the Skill Folder**: Clone this repository into your agent's skills directory (typically located at `~/.agents/skills/`):\n ```bash\n git clone https://github.com/perasyudha/skill-web3.git ~/.agents/skills/web3-ops\n ```\n\n2. **Install Dependencies**: Navigate to the skill folder and install the required dependencies:\n ```bash\n cd ~/.agents/skills/web3-ops\n npm install --omit=dev\n ```\n\n3. **Configure Environment Variables**: Open the main `.env` file of your agent project and configure the required keys:\n ```env\n PRIVATE_KEY=\"0x...\" # The private key of your AI agent's EVM wallet\n \n # Optional: Explorer API Keys (highly recommended for auto-detecting custom/degen tokens in portfolio)\n BASESCAN_API_KEY=\"your_basescan_key\"\n ETHERSCAN_API_KEY=\"your_etherscan_key\"\n ```\n\n4. **Enable Auto-loading**: Upon boot, the agent framework automatically parses the `SKILL.md` manifest in the skill folder. This configures the LLM (e.g. Gemini) to interpret user requests and call the corresponding CLI command dynamically.\n\n## πŸ”Œ Model Context Protocol (MCP) Integration\n\nYou can run this project as a local **Model Context Protocol (MCP) Server**, allowing AI clients like Claude Desktop, Cursor, or Zed to connect to your Web3 wallet and run queries or transactions as native tools.\n\n### 1. Claude Desktop Configuration\nAdd the following configuration to your `claude_desktop_config.json` (located at `%APPDATA%\\Claude\\claude_desktop_config.json` on Windows or `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):\n\n```json\n{\n \"mcpServers\": {\n \"web3-ops\": {\n \"command\": \"node\",\n \"args\": [\"c:/Users/PERASAYUDHA/Documents/Agent/mcp-server.js\"],\n \"env\": {\n \"PRIVATE_KEY\": \"your_private_key_here\",\n \"BASESCAN_API_KEY\": \"your_basescan_key\",\n \"ETHERSCAN_API_KEY\": \"your_etherscan_key\"\n }\n }\n }\n}\n```\n\n*Note: Since the server automatically loads `.env` variables from its local directory, you can also just leave the `env` config in `claude_desktop_config.json` empty if your `.env` file is already set up inside the `web3-ops` folder.*\n\n### 2. Available MCP Tools\nWhen connected, the client exposes the following tools to the LLM:\n* `get_address`: Get your configured wallet address.\n* `get_balance`: Check coin or ERC-20 token balance.\n* `scan_portfolio`: Scan wallet portfolio for active balances.\n* `transfer`: Send coins or ERC-20 tokens (with optional simulation & anti-MEV).\n* `swap`: Swap tokens on the same chain (with optional simulation & anti-MEV).\n* `bridge`: Bridge and swap tokens cross-chain.\n* `mint_nft`: Mint/claim NFTs via contract address or marketplace URL.\n* `custom_tx`: Broadcast custom raw transaction hex data.\n* `get_pnl`: Retrieve Profit & Loss stats for a token.\n* `analyze_contract`: Run smart contract audits via GoPlus API.\n* `get_trading_signal`: Get EMA crossover & RSI signal checks.\n* `track_whales`: Scan explorer transfers for whale activity.\n\n---\n\n## πŸ’ Support & Donation\n\nIf you find this skill useful and want to support its active development, donations are highly appreciated:\n\n* **EVM (Ethereum, Base, Arbitrum, Polygon, etc.)**: `0x18a30d5db50d287dba669c5672cd71246cc4c4c6`\n* **Solana**: `A6tSZZ5wJnTZewx6L5ZHa2Bgv7D2jWyFqwr1bM2AV777`\n\n---\n\n## πŸ›‘οΈ License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\nFile v1.1.4:_meta.json\n\n{\n \"ownerId\": \"kn7b8hnz0597q77crbq7j7ntz985z939\",\n \"slug\": \"web3-ops\",\n \"version\": \"1.1.4\",\n \"publishedAt\": 1780216553294\n}\n\nFile v1.1.4:SECURITY.md\n\n# Security Policy and Architecture\n\nThis document describes the security protocols, threat model, architectural safeguards, and vulnerability reporting procedures for the **OpenClaw Web3 Operations Skill** (`web3-ops`). \n\nAs a non-custodial CLI tool and AI agent skill capable of executing blockchain transactions, security is our absolute design priority.\n\n---\n\n## πŸ”’ 1. Cryptographic Key Management (Zero-Knowledge Architecture)\n\nThe `web3-ops` skill is engineered to ensure that your cryptographic keys (private keys or seed phrases) remain completely secure, private, and localized.\n\n```mermaid\ngraph TD\n A[AI Agent / LLM Interface] -->|1. Generates CLI Command| B(web3-ops Runtime)\n subgraph Local Secure Host Sandbox\n B -->|2. Loads Secrets| C[.env File / Host Process]\n B -->|3. Signs Tx Client-Side| D[Ethers.js Signer]\n D -->|4. Private Key Purged| E((RAM Garbage Collection))\n end\n D -->|5. Sends Broadcast Tx Only| F[Blockchain Network]\n style C fill:#f9f,stroke:#333,stroke-width:2px\n style D fill:#bbf,stroke:#333,stroke-width:2px\n style A fill:#ffb,stroke:#333,stroke-width:2px\n```\n\n### Key Safeguards:\n* **Zero-Knowledge to AI Agent (LLM)**: Large Language Models (LLMs) and remote AI Agents interacting with this tool **never** see or handle your private keys or seed phrases. The LLM only generates CLI parameters (e.g., `--chain`, `--to`, `--token`) and reads public `stdout` results (e.g., transaction hashes, transaction statuses, and balances).\n* **Local-First Transaction Signing**: All cryptographic operations, key derivation, and transaction signing occur strictly client-side within the local Node.js runtime memory using `ethers.js`. Keys are never sent to third-party endpoints, proxy servers, or LLM providers.\n* **Volatile In-Memory Lifecycle**: Your private keys are loaded into system memory only during command execution and are instantly purged when the process terminates. No keys are cached or written to local log files.\n\n---\n\n## πŸ›‘οΈ 2. Threat Model & Permission Boundaries\n\nTo ensure developer and operator confidence, we explicitly define the access limits, capabilities, and system requirements of the `web3-ops` execution loop:\n\n### A. Skill Capabilities & Limits Matrix\n\n| Parameter | Capability / Status | Technical Implementation Detail |\n| :--- | :--- | :--- |\n| **Can Access** | **YES** | Local `.env` file, blockchain RPC nodes, and public price/security APIs (DexScreener, GeckoTerminal, GoPlus). |\n| **Cannot Access** | **NO** | Host filesystem outside the project directory, system settings, user credentials, or other system environment variables. |\n| **Execute Shell** | **NO** | The skill does **not** execute arbitrary shell commands. It does not run scripts, compile external code, or invoke shell interpreters (`sh`, `bash`, `cmd`). It maps strict input arguments to predefined static functions using the `commander` package. |\n| **Sign Transactions** | **YES** | The skill signs transaction payloads locally in memory using `ethers.js` via the configured wallet. It only broadcasts signed payloads to public or private RPCs. |\n| **Store Keys** | **NO / LOCAL ONLY** | The skill has **zero key storage persistence during operations**. It does not cache keys in memory or database them. The only write action is when the operator manually runs the `create-wallet` command to write new credentials to the local `.env` file. This action is protected by strict overwrite prevention. |\n| **Autonomous** | **NO** | The skill is **not autonomous**. It only executes on-demand when called via the CLI. Even the pricing `monitor` command runs in a synchronous, foreground loop started explicitly by the operator and terminates gracefully upon hitting limits or on user cancel (`Ctrl+C`). |\n\n### B. Explicit Permission Boundaries\n\nWhen integrating this skill into an AI Agent framework, the required system permissions are strictly bounded:\n\n> [!IMPORTANT]\n> ### Required Permission Boundary:\n> 1. **Read-Only Blockchain Access**: Enabled by default to fetch native/token balances, resolve token contract addresses, fetch pricing data, track transactions, and perform GoPlus contract audits.\n> 2. **Optional Wallet Signing (Write Access)**: Only requested when executing transaction commands (`transfer`, `swap`, `bridge`, `mint`, `custom`, and `monitor` when limits are breached). If the `PRIVATE_KEY` is not provided, the skill automatically falls back to read-only mode for query-based commands.\n> 3. **No Private Key Persistence**: The skill operates under a strict memory-only lifecycle. No local databases, state files, or cookies are used to retain credentials.\n> 4. **Outbound Network Access**: Bounded strictly to:\n> * Blockchain JSON-RPC endpoints (e.g., private anti-MEV RPCs, public Infura/Alchemy/Ankr nodes).\n> * Public Web3 services: GeckoTerminal API, DexScreener API, GoPlus Security API, Li.Fi Aggregator API.\n> 5. **Wallet Generation Isolation**: The `create-wallet` tool is **excluded from the MCP server tool list**. It can only be executed directly via the local terminal CLI, ensuring that private keys/mnemonics are never transmitted over network contexts to LLM providers during generation.\n\n---\n\n## πŸ›‘οΈ 3. On-Chain Security Features\n\nTo protect your assets from common on-chain exploits (such as malicious smart contracts or sandwich attacks), `web3-ops` includes built-in protective features:\n\n### A. Smart Contract Audit Integration (`analyze`)\nBefore interacting with any new or untrusted token, users or AI agents can invoke the `analyze` command:\n* **GoPlus Security API**: Checks the target token address across 30+ threat indicators.\n* **Threat Indicators Analyzed**:\n * **Honeypot Risk**: Checks if selling is restricted or if the contract has blacklist/whitelist functions.\n * **Tax Structure**: Detects unusually high buy/sell transfer taxes.\n * **Access Control**: Warns if the contract is mintable, has owner-backdoors, or has not renounced ownership.\n * **Proxy Contracts**: Highlights if the implementation can be upgraded maliciously.\n\n### B. Anti-MEV (Maximal Extractable Value) Protection (`--anti-mev`)\nTo avoid being frontrun or sandwiched on public mempools, you can append the `--anti-mev` flag to your transactions:\n* **Private Mempool Routing**: Instead of broadcasting to public RPCs, the tool routes transactions directly to MEV-resistant private block builders (e.g., Flashbots Protect on Ethereum, bloXroute, or private builders on BNB Chain).\n* **Zero Slippage Exploitation**: By bypassing the public mempool, searcher bots cannot detect your swap or sandwich your trade.\n\n### C. Transaction Simulation (`--simulate`)\nBefore broadcasting transactions, the `--simulate` option simulates the execution using `estimateGas` and dry-run calls against the current state of the blockchain.\n* Prevents wasting transaction gas on failing transactions.\n* Identifies contract reverts prior to broadcasting.\n\n---\n\n## βš™οΈ 4. Security Hardening Best Practices\n\nIf you are running this tool in production or exposing it to an AI Agent, we strongly recommend following these hardening guidelines:\n\n| Category | Best Practice | Rationale |\n| :--- | :--- | :--- |\n| **Wallet Setup** | Use a dedicated **Hot Wallet** containing only the assets required for immediate operations. | Minimizes the blast radius in case the host machine is compromised. |\n| **Permissions** | Set restrictive permissions on the `.env` file containing your keys (e.g., `chmod 600 .env` on Unix-like environments). | Prevents unauthorized local users from reading your credentials. |\n| **Private RPCs** | Configure custom private RPC endpoints using the `--rpc` option. | Enhances network reliability, reduces rate limits, and improves privacy. |\n| **Environment Separation**| Run the AI Agent and the `web3-ops` execution environment in a sandboxed or containerized environment (e.g., Docker). | Restricts the LLM's system access and prevents path traversal to the `.env` file. |\n\n---\n\n## πŸ› 5. Reporting Vulnerabilities\n\nIf you discover a security vulnerability in this project, please report it to us immediately. **Do not open a public GitHub issue for security bugs.**\n\n### Reporting Process:\n1. Send a detailed description of the vulnerability directly to the project maintainer via safe/private channels.\n2. Include a proof of concept (PoC) or step-by-step instructions to reproduce the issue.\n3. We will acknowledge receipt of your report within **24 hours** and provide a status update on a fix within **72 hours**.\n\n### Responsible Disclosure Guidelines:\nWe ask you to follow responsible disclosure guidelines:\n* Allow us reasonable time to investigate and remediate the issue before publishing any information about it.\n* Do not attempt to exploit the vulnerability or access user funds.\n* Do not perform denial-of-service (DoS) attacks or run automated stress-testing scanners against public infrastructure.\n\n---\n\n## πŸ“œ 6. Disclaimer\n\n*This software is provided \"as is\", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages, or other liability, whether in an action of contract, tort, or otherwise, arising from, out of, or in connection with the software or the use or other dealings in the software.*\n\nFile v1.1.4:skill-card.md\n\n## Description:\n\nPerform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping or bridging tokens, minting NFTs, tracking PnL, monitoring token prices, generating trading signals, auditing token contracts, tracking whale transfers, and creating wallets.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[nyxoraai](https://clawhub.ai/user/nyxoraai)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nExternal users and developers use this skill to let an agent prepare and run EVM wallet, portfolio, token transfer, swap, bridge, NFT minting, trading-signal, and contract-audit workflows through a local Node.js CLI or MCP tool surface. It is intended for operator-directed Web3 operations where transaction parameters and outputs are reviewed before funds are put at risk.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Fund-moving tools can transfer assets, swap or bridge tokens, mint NFTs, broadcast custom transactions, and run monitored sell actions.\n\nMitigation: Use a dedicated low-value wallet, simulate first where possible, and add independent confirmation plus spending limits before enabling transaction-capable MCP tools.\n\nRisk: Wallet secrets may become available to agent-connected workflows through .env or MCP configuration.\n\nMitigation: Do not place a main wallet private key or mnemonic in an agent-accessible environment; keep production keys outside the agent runtime.\n\nRisk: The create-wallet command prints and writes recovery material, making terminal output and logs sensitive.\n\nMitigation: Run wallet generation only in a local trusted terminal, handle the printed private key and mnemonic as secrets immediately, and clear exposed history or logs.\n\n## Reference(s):\n\n- [ClawHub Web3 Ops Skill Page](https://clawhub.ai/nyxoraai/skills/web3-ops)\n- [Publisher Profile](https://clawhub.ai/user/nyxoraai)\n- [README](artifact/README.md)\n- [Security Policy and Architecture](artifact/SECURITY.md)\n- [Skill Definition](artifact/SKILL.md)\n\n## Skill Output:\n\n**Output Type(s):** [text, markdown, shell commands, configuration, guidance, JSON]\n\n**Output Format:** [Markdown guidance with inline shell commands and JSON command output]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Can emit transaction hashes, explorer links, balances, audit summaries, trading indicators, whale alerts, and wallet recovery material depending on the command.]\n\n## Skill Version(s):\n\n1.1.4 (source: server release metadata and package.json)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nFile v1.1.4:package.json\n\n{\n \"name\": \"openclaw-web3-ops\",\n \"version\": \"1.1.4\",\n \"description\": \"Web3 On-chain operations skill for OpenClaw (Gemini Telegram Bot)\",\n \"main\": \"index.js\",\n \"type\": \"module\",\n \"files\": [\n \"SKILL.md\",\n \"README.md\",\n \"index.js\",\n \"mcp-server.js\",\n \"actions\",\n \"bin\"\n ],\n \"bin\": {\n \"openclaw-web3-ops\": \"./bin/install.js\"\n },\n \"scripts\": {\n \"start\": \"node index.js\",\n \"mcp\": \"node mcp-server.js\"\n },\n \"dependencies\": {\n \"@modelcontextprotocol/sdk\": \"^1.29.0\",\n \"axios\": \"^1.6.8\",\n \"commander\": \"^12.0.0\",\n \"dotenv\": \"^16.4.5\",\n \"ethers\": \"^6.12.1\"\n }\n}\n\nArchive v1.1.3: 20 files, 63408 bytes\n\nFiles: actions/auditor.js (9296b), actions/common.js (21346b), actions/customTx.js (2803b), actions/mintNft.js (13138b), actions/monitor.js (7032b), actions/pnl.js (9533b), actions/signals.js (10111b), actions/swapBridge.js (15660b), actions/transfer.js (3455b), actions/wallet.js (16062b), actions/whales.js (6656b), bin/install.js (4200b), index.js (9068b), mcp-server.js (13456b), package.json (495b), README.md (26106b), SECURITY.md (9485b), skill-card.md (2849b), SKILL.md (9540b), _meta.json (127b)\n\nFile v1.1.3:SKILL.md\n\n---\nname: web3-ops\ndescription: Perform EVM Web3 on-chain operations: check addresses, scan portfolios, transfer assets, swap/bridge tokens, mint NFTs, custom raw tx, PnL tracking, Cutloss/Takeprofit monitor, RSI/EMA trading signals, GoPlus contract security audits, whale tracking, anti-MEV route routing, and wallet creation.\n\nenv:\n - PRIVATE_KEY\n\nrequirements:\n bins:\n - node\n---\n# Secure AI-Native Web3 Operational Skill\n\nThis skill allows the OpenClaw AI agent to interface with EVM blockchains (Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Sonic, Sepolia, etc.) using a local Node.js CLI utility under a strict Human-in-the-Loop safety model.\n\n\n## Global Options\n\nThese flags can be appended to any command:\n* `--json`: Silences human logs and outputs strictly JSON to `stdout` (highly recommended for AI agent parsing).\n* `--rpc `: Overrides default node RPC with a custom RPC endpoint (useful for testnets or private nodes).\n* `--simulate`: Simulates the transaction (dry run) using gas estimation and call simulation. Prevents sending failing transactions and calculates gas fees.\n\n## CLI Commands & Arguments\n\nAll commands are run using Node.js inside the skill directory:\n`node skills/web3-ops/index.js [arguments]`\n\n### 1. Get Wallet Address\nGet your configured wallet address.\n* **Usage:** `node skills/web3-ops/index.js address [--json]`\n\n### 2. Check Specific Balance\nCheck native coin (ETH, MATIC, BNB, S) or a specific ERC-20 token balance using symbol or contract address.\n* **Native Coin:** `node skills/web3-ops/index.js balance --chain [--json]`\n* **ERC-20 Token:** `node skills/web3-ops/index.js balance --chain --token [--json]`\n* *Example:* `node skills/web3-ops/index.js balance --chain base --token AERO`\n\n### 3. Scan Portfolio (New)\nScan and list all tokens with a positive balance in your wallet. If no chain is specified, it will scan all supported networks in parallel. Automatically detects \"degen/micin\" tokens using block explorer transaction history.\n* **Usage (All Chains):** `node skills/web3-ops/index.js portfolio [--json]`\n* **Usage (Single Chain):** `node skills/web3-ops/index.js portfolio --chain [--json]`\n\n### 4. Transfer Coins or Tokens\nSend native coins or ERC-20 tokens to another address.\n* **Native Coin:** `node skills/web3-ops/index.js transfer --chain --to --amount [--json] [--simulate]`\n* **ERC-20 Token:** `node skills/web3-ops/index.js transfer --chain --to --amount --token [--json] [--simulate]`\n\n### 5. Swap Tokens (Same-Chain)\nSwap tokens on the same blockchain network. Supports auto-routing and manual routers.\n* **Auto Mode (Li.Fi Aggregator):**\n `node skills/web3-ops/index.js swap --chain --fromToken --toToken --amount --mode auto [--json] [--simulate]`\n* **Manual Mode (Uniswap/PancakeSwap/Relay/Li.Fi):**\n `node skills/web3-ops/index.js swap --chain --fromToken --toToken --amount --mode manual --provider [--json] [--simulate]`\n* **Slippage Tolerance:** Add `--slippage ` (default is 0.5)\n\n### 6. Bridge Tokens (Cross-Chain)\nBridge and swap assets from one blockchain to another.\n* **Auto Mode (Li.Fi Aggregator):**\n `node skills/web3-ops/index.js bridge --fromChain --toChain --fromToken --toToken --amount --mode auto [--json] [--simulate]`\n* **Manual Mode (Relay/Li.Fi):**\n `node skills/web3-ops/index.js bridge --fromChain --toChain --fromToken --toToken --amount --mode manual --provider [--json] [--simulate]`\n\n### 7. Mint NFT\nMint or claim NFTs on a smart contract.\n* **Usage:** `node skills/web3-ops/index.js mint --chain --contract [--function ] [--args ] [--value ] [--json] [--simulate]`\n* *Note:* `--function`, `--args`, and `--value` are optional. If omitted, the skill will fetch the verified contract ABI from the explorer, auto-detect the mint function (e.g., `mint`, `claim`), and infer the arguments automatically.\n* *Example:* `node skills/web3-ops/index.js mint --chain base --contract 0x123...`\n\n\n### 8. Custom Transaction (Raw Transaction)\nBroadcast a custom raw transaction with hex data payload.\n* **Usage:** `node skills/web3-ops/index.js custom --chain --to --data --value [--json] [--simulate]`\n\n### 9. Profit & Loss Tracker (PnL)\nCalculate the average buy price and current profit/loss of a token.\n* **Usage:** `node skills/web3-ops/index.js pnl --chain --token [--buyPrice ] [--json]`\n\n### 10. Cutloss & Takeprofit Monitor\nMonitor token price in real-time and execute a pre-authorized safety swap to USDC if limits are reached.\n* **Usage:** `node skills/web3-ops/index.js monitor --chain --token --amount --cutloss --takeprofit [--max-checks ] [--interval ] [--alert] [--json]`\n\n### 11. Trading Signals\nFetch daily candles and analyze RSI (14) & EMA (20/50) indicators to generate Buy/Sell recommendations.\n* **Usage:** `node skills/web3-ops/index.js signal --chain --token [--alert] [--json]`\n\n### 12. Smart Contract Auditor\nPerform a GoPlus security audit to detect honey pots, taxes, and code privileges.\n* **Usage:** `node skills/web3-ops/index.js analyze --chain --token [--json]`\n\n### 13. Whale Tracker\nScan block explorer transfers for large transaction amounts exceeding a threshold.\n* **Usage:** `node skills/web3-ops/index.js whales --chain --token [--min-usd ] [--alert] [--json]`\n\n### 14. Create EVM Wallet\nGenerate a random EVM wallet and automatically write its credentials to `.env`.\n* **Usage:** `node skills/web3-ops/index.js create-wallet [--force] [--json]`\n* *Security Warning:* Run this command only locally in the CLI terminal. Do not let AI agents trigger it remotely over chat interfaces.\n\n---\n\n\n## Agent Behavior & Telegram Prompt Guidelines\n\nWhen interacting with the user regarding blockchain transactions:\n1. **Translate Intent to CLI:** Convert the user's natural language requests (e.g., \"Check my Base portfolio\", \"Swap 10 USDC to ETH on Base\", \"Send 0.01 Sepolia ETH to 0x...\") into the corresponding CLI command. Always append `--json` for programmatic parsing.\n2. **No Raw JSON Outputs (CRITICAL):** Never output raw JSON (such as `{ \"success\": true, ... }`) directly to the user. Always parse the command's JSON output and translate it into a natural, friendly, and engaging human-readable response.\n3. **Utilize Simulation Mode:** If the user is unsure, asks \"will this transaction work?\", or is making a high-value transfer, suggest simulating it first using `--simulate`.\n4. **Display Copyable Addresses (CAs):** When printing token balances, portfolios, or transaction confirmations, format all contract addresses (CA) inside Telegram monospace code blocks (e.g. `` `0x940181a94A35A4569E4529A3CDfB74e38FD98631` ``) so users can tap to copy them instantly.\n5. **Support Testnets & Custom RPCs:** If the user specifies a testnet (e.g., Sepolia) or requests a private RPC, append the `--rpc` flag to the command.\n6. **Explorer Links:** Always extract the `explorer` link from the output JSON and present it to the user so they can track block confirmation status.\n7. **Security Notice:** Never request seed phrases, mnemonics, or private keys. The wallet configuration is loaded securely from the local server's `.env` file.\n8. **Casual & Friendly Tone:** Explain transaction results, balances, or confirmations in a natural, casual, and friendly everyday chat style (e.g., like a helpful Web3 degen companion). Avoid robotic or overly dry responses, but always keep technical fields (like contract addresses and transaction hashes) accurate and formatted for easy copying.\n9. **Format PnL Reports:** Summarize PnL reports into friendly bullets. E.g., mention the current balance, average buy price, current market price, and the overall gain/loss in USD and ROI percentage.\n10. **Format Security Audits:** Highlight whether the contract is safe or a honeypot, buying/selling taxes, and list any risk findings with appropriate alert emojis (e.g., 🚨, ⚠️, ℹ️).\n11. **Format Trading Signals:** Present the overall signal recommendation (e.g., \"STRONG BUY\" in bold) along with the RSI (14) value and the EMA trend.\n12. **Format Whale Alerts:** Summarize detected whale transactions by showing the USD value, the amount of tokens, sender/receiver addresses, and a link to the transaction hash.\n13. **NFT Mint Autodetection:** If the user asks to mint an NFT by providing a contract address or marketplace/explorer link without specifying the function signature or arguments, run the `mint` command and omit the `--function`, `--args`, and `--value` parameters. The skill will automatically fetch the verified contract ABI, detect the mint function, and infer the arguments. Always suggest simulation using `--simulate` first to verify correctness.\n\nFile v1.1.3:README.md\n\n# OpenClaw Web3 Operations Skill\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Security: Security-First](https://img.shields.io/badge/Security-Security--First-blue.svg)](#)\n[![Execution: Human-in-the-Loop](https://img.shields.io/badge/Execution-Human--in--the--Loop-orange.svg)](#)\n[![Privacy: Local-Only Keys](https://img.shields.io/badge/Privacy-Local--Only--Keys-success.svg)](#)\n\n![Skill-Web3 Logo](assets/logo.png)\n\nA **secure, non-custodial, AI-native Web3 operational skill with explicit execution safety** built with Node.js and Ethers.js v6. Designed for agentic workflows to execute wallet operations with client-side key isolation. It operates under a strict **Human-in-the-Loop** execution model, requiring explicit operator approval for any on-chain transaction.\n\n---\n\n\n\n## Key Features\n\n### Advanced Trading & Security Features (New in v1.1.0)\n* **Wallet Generation (`create-wallet`)**: Generate a random EVM address, private key, and mnemonic locally. Automatically saves them to the `.env` file with secure overwrite protection.\n* **PnL Tracker (`pnl`)**: Automatically parses incoming/outgoing token transfers via Block Explorer APIs to compute the weighted average cost basis (Avg Buy Price) of your holdings. Compares this with real-time market prices from DexScreener to calculate net USD profit/loss (PnL) and percentage ROI.\n* **Cutloss & Takeprofit Monitor (`monitor`)**: Run active price monitoring in the foreground. Configurable with cutloss and takeprofit bounds (nominal USD or percentage-based). Executes a pre-authorized safety swap to USDC via the Li.Fi aggregator when price boundaries are crossed.\n* **Technical Trading Signals (`signal`)**: Fetches daily candle data (OHLCV) via the GeckoTerminal API to calculate **RSI (14)** and **EMA (20/50)** crossovers, returning trade recommendations (`STRONG BUY`, `BUY`, `NEUTRAL`, `SELL`, or `STRONG SELL`).\n* **Smart Contract Audit (`analyze`)**: Integrates GoPlus Security API to audit token contracts. Detects Honeypots, Buy/Sell taxes, Mintable supplies, Proxy configurations, and Ownership statuses to return a comprehensive security score.\n* **Whale tracker (`whales`)**: Scans recent block explorer token transfers to filter and detect transfers exceeding user-defined USD thresholds (default: $50,000).\n* **Anti-MEV Protection (`--anti-mev`)**: Routes transactions on supported networks (Ethereum, Polygon, BSC) through private RPC nodes (e.g. Flashbots Protect, BloXroute) to defend against sandwich attacks by searchers.\n* **Agent-Ready Alerts (`--alert`)**: Commands like `monitor`, `signal`, and `whales` support a `--alert` flag that embeds specific JSON alert payloads when targets are hit, enabling instant Telegram/Discord broadcast hooks.\n\n\n### Core Features\n* **Dynamic Token Resolution**: No more manual contract address lookups. Enter symbols like `USDC`, `AERO`, or `PEPE` directlyβ€”the tool dynamically resolves them to their correct contract addresses on-the-fly via the Li.Fi indexer.\n* **Smart Portfolio Scan (`portfolio`)**: Automatically scans the wallet's transaction history via block explorer APIs (Etherscan, Basescan, etc.) to discover all active tokens with a balance (`balance > 0`). Perfect for tracking meme/degen coins automatically.\n* **Click-to-Copy Contract Addresses (CA)**: Lists contract addresses alongside token symbols. When combined with `--json`, it allows Telegram bots to format them inside backticks (e.g., `` `0x...` ``) for click-to-copy convenience.\n* **Transaction Simulation (`--simulate`)**: Performs an off-chain dry run using `estimateGas` and EVM simulation before broadcasting. Avoid wasted gas fees on reverting transactions!\n* **Multi-Bridge & Swap Routing**: Supports automatic best-route discovery via **Li.Fi Aggregator**, or manual routes via **Relay.link** (ultra-fast bridging), **Uniswap V3**, and **PancakeSwap V3**.\n* **AI Agent Friendly (`--json`)**: Appending `--json` silences all human-oriented logs and returns clean, structured JSON to `stdout` for reliable agent parsing.\n* **Broad Network Support**: Pre-configured support for Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Avalanche, Linea, Scroll, zkSync, **Sonic (Mainnet)**, and **Berachain (Testnet)**, plus Sepolia and Base Sepolia testnets.\n* **RPC & Node Customization (`--rpc`)**: Override default public RPC nodes with custom private RPCs or testnet nodes dynamically on a per-command basis.\n* **Premium Terminal UI**: Outputs colored, readable CLI logs using ANSI color coding.\n\n---\n\n## πŸ“ Architecture Workflow\n\nThis diagram shows how a transaction flows from the CLI command (or Telegram user request) to its on-chain execution:\n\n```mermaid\ngraph TD\n A[User Command / Telegram Bot] -->|Runs CLI Command| B(web3-ops CLI)\n B --> C{Dynamic Token Resolution}\n C -->|Symbol e.g. AERO| D[Fetch contract address from Li.Fi Token Index]\n C -->|0x Address / Native| E[Use directly]\n D --> F{Transaction Simulation}\n E --> F\n F -->|--simulate| G[Execute gas estimation & call dry run]\n G -->|Success / Revert| H[Output Gas / Revert JSON & Exit]\n F -->|Standard run| I[Submit Tx to Blockchain Node]\n I --> J[Wait for Block Confirmation]\n J --> K{Select Output Format}\n K -->|--json| L[Return structured JSON to stdout]\n K -->|Standard| M[Render ANSI-colored human-readable log]\n```\n\n---\n\n## πŸ›‘οΈ Safety Model\n\nTo protect user assets and prevent common security concerns associated with blockchain-based agent tools, `web3-ops` operates under a strict safety specification:\n\n* **No Seed Phrase Handling**: The skill never requests, stores, or accesses mnemonics/seed phrases directly during active operations. \n* **No Credential Collection**: Private keys are handled strictly within local volatile memory and are never transmitted over network endpoints, APIs, or AI provider systems.\n* **Explicit Transaction Confirmation**: Write actions (like transfers, swaps, bridges) require manual, explicit confirmation from the human operator before broadcasting.\n* **Human-in-the-Loop Execution**: The tool is engineered as a secure operational utility. The AI agent acts as a command generator and output parser, leaving execution authority with the human controller.\n\n---\n\n## πŸ“‹ Example Safe Workflows\n\nThe skill is designed for early-stage testing, basic Web3 exploration, and secure transaction simulation. Typical workflows include:\n\n* **Audit New Tokens**: Perform quick security checks on newly discovered token contract addresses to check for high taxes or honeypot risks.\n* **Track Portfolio Assets**: Inspect wallet balances and token holdings across multiple EVM networks simultaneously.\n* **Analyze Transferred Tokens**: Check transaction history and track recent asset interactions.\n* **Simulate Before Executing**: Test transactions off-chain (`--simulate`) to verify gas fees and confirm successful execution before broadcast.\n\n---\n\n## πŸ”’ Security, Threat Model & Permission Boundary\n\n\nThis skill is designed with a **Zero-Knowledge to LLM** architectural pattern to ensure the highest levels of security and confidentiality for your private keys and seed phrases:\n\n* **Zero-Knowledge to AI Agent (LLM)**: Remote AI Agents and Large Language Models (LLMs) **never** handle your private keys. The LLM only translates natural language into secure command-line parameters (e.g., `--chain`, `--to`, `--token`) and reads public `stdout` responses.\n* **Cryptographic Memory Isolation**: Transaction signing occurs strictly client-side within the local Node.js process runtime using `ethers.js`. Secrets are loaded only into volatile process memory and garbage-collected immediately upon command completion.\n\n### πŸ›‘οΈ Threat Model\n* **Access Limits**: The skill can **only** read its own directory, custom configuration variables from `.env`, and public blockchain information (RPCs, Explorer APIs, Price feeds).\n* **No Arbitrary Shell Execution**: The skill **does not execute any arbitrary commands or scripts** from inputs. Every user request maps strictly to predefined static functions using parameters parsed via `commander`.\n* **No Key Storage Persistence during operations**: The skill does not cache, database, or store keys in memory. The single write action occurs when the operator manually runs the local `create-wallet` command to write new credentials to the local `.env` file, protected by overwrite prevention.\n* **Non-Autonomous Loop**: The tool never executes unsolicited on-chain actions. Execution is entirely on-demand. Even the price `monitor` command runs in a foreground loop that can be exited safely via user cancellation (`Ctrl+C`).\n\n### πŸ“‹ Permission Boundary Matrix\n\n| Access Category | Permission Boundary | Rationale |\n| :--- | :--- | :--- |\n| **Read Access** | Read-Only Blockchain Queries | Fetching balances, contract security audits, transaction logs, and technical indicators. |\n| **Write Access**| Optional Wallet Signing | Required **only** for broadcasting transactions (swap, bridge, mint, transfer). Falls back to read-only mode if no keys are set. |\n| **Network Access**| Bounded Public APIs | Restricted strictly to the configured RPC endpoints, Block Explorers, DexScreener, GeckoTerminal, and GoPlus. |\n| **System Access**| Local Directory Sandboxing | No write permissions requested outside the local project directory (except for writing newly generated wallet credentials to the local `.env` file during the `create-wallet` command). No system-level command execution. |\n\n\nFor the full detailed security specifications, contact info, and vulnerability reporting procedures, refer to the [SECURITY.md](SECURITY.md) policy document.\n\n---\n\n## πŸš€ Quick Start & Installation\n\nYou can install this skill in three different ways depending on your preference:\n\n### Opsi A: Automated NPX Installer (Recommended)\nYou can install this skill directly using our GitHub repository shorthand:\n```bash\n# Installs the latest version (v1.1.0 - Advanced Trading & Security)\nnpx github:perasyudha/skill-web3\n\n# Installs the previous stable version (v1.0.1 - NFT & Sandboxing updates)\nnpx github:perasyudha/skill-web3#v1.0.1\n```\n*Note: If the package is published to the npm registry under `openclaw-web3-ops`, you can also use:*\n```bash\nnpx openclaw-web3-ops\n# Or for previous version:\nnpx openclaw-web3-ops@1.0.1\n```\nTo install to a custom path instead of the default `~/.agents/skills/web3-ops`, pass the path as an argument:\n```bash\nnpx github:perasyudha/skill-web3#v1.0.1 ./my-custom-path/web3-ops\n```\n\n### Opsi B: Conversational Install via AI Agent\nIf you are running an AI Agent (like Claude Code, Cursor, or OpenClaw) with terminal capabilities, simply paste the following prompt in the chat:\n> *\"Please install the web3-ops skill from https://github.com/perasyudha/skill-web3.git\"*\nThe agent will automatically clone, setup the folder structure, and install dependencies.\n\n### Opsi C: Manual Setup\nClone this repository and install the dependencies manually:\n```bash\ngit clone https://github.com/perasyudha/skill-web3.git\ncd skill-web3\nnpm install\n```\n\n### 2. Wallet Configuration\n\nTo process transactions, the AI Agent requires a dedicated cryptocurrency wallet. We strongly recommend creating a fresh, dedicated wallet (Burner Wallet) specifically for this bot.\n\nBefore starting, **ensure your terminal is inside the installation folder** by typing:\n```bash\ncd ~/.openclaw/plugin-skills/web3-ops\n```\n\nChoose one of the following setup methods:\n\n**Option A: Auto-Generate Wallet (Highly Recommended πŸ”₯)**\nThe easiest way! Simply run this command in your terminal:\n```bash\nnode index.js create-wallet\n```\nThe system will automatically generate a new wallet and securely store your *Private Key* in the `.env` file. *(Don't forget to write down the Mnemonic/Seed Phrase displayed on your screen!)*\n\n**Option B: Import Existing Wallet (Manual)**\nIf you prefer to use an existing wallet (e.g., from MetaMask):\n1. Open **File Explorer** (Windows), **Finder** (Mac), or **File Manager / Files** (Linux), and navigate to the `~/.openclaw/plugin-skills/web3-ops` folder. \n *(Tip: On Linux/Mac, press `Ctrl+H` or `Cmd+Shift+.` to reveal hidden files).*\n2. Rename the `.env.example` file to `.env`.\n3. Open the `.env` file using a built-in app like **Notepad** (Windows), **TextEdit** (Mac), or **Text Editor / Nano** (Linux).\n4. Remove the `#` symbol and insert your Private Key like this:\n `PRIVATE_KEY=\"0xYourPrivateKeyHere...\"`\n5. Save the file.\n\n> **⚠️ SECURITY WARNING:** Never share your `.env` file or Private Key with anyone!\n\n**Verify Your Setup:**\nRun this command in the terminal to ensure your wallet is correctly connected:\n```bash\nnode index.js address\n```\nIf successful, your public wallet Address will be printed on the screen.\n\n### 3. Private RPC Configuration (Optional but Recommended)\n\nBy default, this skill works out-of-the-box using free public connections. However, if your transactions frequently fail, process slowly, or you want to execute trades faster, we highly recommend setting up a **Private RPC**.\n\n**How to set it up:**\n\n1. Sign up for a free account at [Alchemy.com](https://www.alchemy.com/).\n2. Create a new App (Select your desired network, e.g., *Base* or *Ethereum Mainnet*).\n3. Copy the **HTTPS URL** from your *API Key* button.\n4. Open **File Explorer** (Windows), **Finder** (Mac), or **File Manager** (Linux), and navigate to the `~/.openclaw/plugin-skills/web3-ops` folder.\n *(Tip: On Linux/Mac, press `Ctrl+H` or `Cmd+Shift+.` to reveal hidden files).*\n5. Open your `.env` file using **Notepad** (Windows), **TextEdit** (Mac), or **Text Editor** (Linux).\n6. Find the network line that matches your Alchemy App, and paste the URL inside the quotation marks.\n *Example for the Base network:* \n `BASE_RPC_URL=\"https://base-mainnet.g.alchemy.com/v2/YOUR_API_KEY\"`\n7. Save the file.\n\nDone! Your AI Agent will now automatically route transactions through this VIP/Private connection, ensuring maximum speed and reliability.\n\n---\n\n## πŸ’» CLI Commands & Examples\n\n### Generate New EVM Wallet (create-wallet)\nIf you do not have an EVM wallet or want to generate a fresh one, run the `create-wallet` command. It will generate a random wallet and automatically write its credentials (`PRIVATE_KEY` and `MNEMONIC`) to your local `.env` file:\n```bash\nnode index.js create-wallet\n```\n*Note: To prevent accidental loss of funds or keys, this command will immediately abort and refuse to run if it detects that you already have a wallet configured in `.env`. To force overwriting of existing keys, use the `--force` flag:*\n```bash\nnode index.js create-wallet --force\n```\n\n### Get Wallet Address\nFind out which wallet address is currently configured in the environment:\n```bash\nnode index.js address\n```\n\n### Check Native/Token Balances\nCheck native coin balance on Arbitrum:\n```bash\nnode index.js balance --chain arbitrum\n```\n\nCheck a specific ERC-20 token (AERO on Base) using its symbol:\n```bash\nnode index.js balance --chain base --token AERO\n```\n\n### Scan Portfolio (Auto-detecting Tokens)\nScan and list all tokens with a positive balance in your wallet. It automatically detects any bought \"degen/micin\" tokens using Basescan API and lists them with copyable Contract Addresses (CA):\n```bash\nnode index.js portfolio --chain base\n```\n*Sample Visual Output:*\n```text\n==================================================\nPORTFOLIO SUMMARY: Base\nAddress: 0x6152aBCde71F...\n==================================================\nETH : 0.024501\nUSDC : 120.500000 (CA: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)\nAERO : 415.000000 (CA: 0x940181a94A35A4569E4529A3CDfB74e38FD98631)\n==================================================\n```\n\n### Transfer Coins/Tokens\nSend `0.005 ETH` to a recipient on Base:\n```bash\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 0.005\n```\n\nSend `50 USDC` to a recipient on Base:\n```bash\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 50 --token USDC\n```\n\n### Swap Tokens (Same-Chain)\nSwap `10 USDC` to `ETH` on Base using auto-routing (Li.Fi):\n```bash\nnode index.js swap --chain base --fromToken USDC --toToken ETH --amount 10 --mode auto\n```\n\nSwap `50 USDC` to `WETH` on Base manually using **Uniswap V3** (simulate first to double-check):\n```bash\nnode index.js swap --chain base --fromToken USDC --toToken WETH --amount 50 --mode manual --provider uniswap --simulate\n```\n\n### Bridge Tokens (Cross-Chain)\nBridge `0.01 ETH` from Arbitrum to `USDC` on Base using auto-routing:\n```bash\nnode index.js bridge --fromChain arbitrum --toChain base --fromToken ETH --toToken USDC --amount 0.01 --mode auto\n```\n\nBridge `0.05 ETH` from Optimism to `ETH` on Base manually using **Relay** (ultra-fast cross-chain routing):\n```bash\nnode index.js bridge --fromChain optimism --toChain base --fromToken ETH --toToken ETH --amount 0.05 --mode manual --provider relay\n```\n\n### Mint NFT\nMint an NFT on Base by calling the `claim(address,uint256)` function with arguments:\n```bash\nnode index.js mint --chain base --contract 0x123456789... --function \"claim(address,uint256)\" --args '[\"0xYourAddress\", 1]' --value 0.00075\n```\n\n### Broadcast Custom Transaction\nSend custom hex data to a smart contract:\n```bash\nnode index.js custom --chain base --to 0xTargetAddress --data 0xa9059cbb000000000000000000000000742d35cc6634c0532925a3b844bc454e4438f44e0000000000000000000000000000000000000000000000000de0b6b3a7640000\n```\n\n---\n\n## πŸ“– Real-World User-Agent Workflows & Demos\n\n\nBelow are standard interaction cycles showing how an AI Agent (e.g. OpenClaw) leverages the `web3-ops` skill under the hood to fulfill user requests safely and present natural-language responses.\n\n### 1. Simple Read: \"check ETH balance\"\nWhen a user asks to inspect their balance, the agent resolves the chain name and runs a read-only query.\n\n```text\nUser πŸ’¬: \"How much ETH do I have on Base?\"\n\nAgent πŸ€– (Executing tool command):\n$ node index.js balance --chain base --json\n\nSystem Output πŸ–₯️:\n{\n \"success\": true,\n \"chain\": \"Base\",\n \"address\": \"0x6152aBCde71F2bA7d863D5cE5e6629910c66F81b\",\n \"balance\": \"0.024501\",\n \"symbol\": \"ETH\"\n}\n\nAgent πŸ€– (Presented to User):\n\"You have 0.024501 ETH on Base in your configured wallet (0x6152...F81b).\"\n```\n\n---\n\n### 2. Smart Contract Audit: \"audit contract AERO\"\nWhen a user queries the security status of an address, the agent uses the `analyze` command to audit the contract via GoPlus Security API before proposing any transaction.\n\n```text\nUser πŸ’¬: \"Audit the contract for AERO on Base, is it safe to buy?\"\n\nAgent πŸ€– (Executing tool command):\n$ node index.js analyze --chain base --token AERO --json\n\nSystem Output πŸ–₯️:\n{\n \"success\": true,\n \"tokenName\": \"Aerodrome\",\n \"symbol\": \"AERO\",\n \"address\": \"0x940181a94A35A4569E4529A3CDfB74e38FD98631\",\n \"securityScore\": 90,\n \"isHoneypot\": false,\n \"buyTax\": 0,\n \"sellTax\": 0,\n \"isProxy\": false,\n \"isMintable\": true,\n \"ownerRenounced\": true,\n \"risks\": [\n {\n \"severity\": \"LOW\",\n \"description\": \"Owner can mint additional tokens, causing potential dilution.\"\n }\n ]\n}\n\nAgent πŸ€– (Presented to User):\n\"I've completed a smart contract audit for Aerodrome (AERO) on Base.\nπŸ›‘οΈ Security Score: 90/100\n- Honeypot: No (Selling is fully enabled)\n- Trading Tax: 0% Buy / 0% Sell\n- Proxy contract: No (Implementation cannot be altered)\n- Owner: Renounced (No backdoors detected)\n\n⚠️ Risk: The contract is mintable (dilution is possible). Overall, it is considered safe for normal trading.\"\n```\n\n---\n\n### 3. Safe Swapping with MEV Protection: \"swap 10 USDC to ETH on Base\"\nWhen a user initiates a transaction, the agent performs a transaction simulation and applies anti-MEV routing automatically to protect against frontrunning.\n\n```text\nUser πŸ’¬: \"Swap 10 USDC to ETH on Base. Protect me from MEV.\"\n\nAgent πŸ€– (Executing tool command):\n$ node index.js swap --chain base --fromToken USDC --toToken ETH --amount 10 --anti-mev --json\n\nSystem Output πŸ–₯️:\n{\n \"success\": true,\n \"chain\": \"Base\",\n \"hash\": \"0x5d9b626e2e51927cb8ec775de6f78f8cb0865c404cfb92d6e3c49e29a1bcf88e\",\n \"from\": \"0x6152aBCde71F2bA7d863D5cE5e6629910c66F81b\",\n \"fromToken\": \"USDC\",\n \"toToken\": \"ETH\",\n \"amountIn\": \"10\",\n \"amountOut\": \"0.003185\",\n \"antiMevRouted\": true\n}\n\nAgent πŸ€– (Presented to User):\n\"Successfully swapped 10 USDC for 0.003185 ETH on Base. \n⚑ Transaction was routed securely through private RPC nodes to prevent sandwich/MEV attacks.\nπŸ”— View transaction on Basescan: https://basescan.org/tx/0x5d9b626e2e51927cb8ec775de6f78f8cb0865c404cfb92d6e3c49e29a1bcf88e\"\n```\n\n---\n\n## πŸ€– Integrator & AI Agent Options\n\n\n### Structured JSON Output (`--json`)\nAI agents and bots should always append `--json` to commands. All status messages are silenced, and only the final operation result is written to `stdout`.\n\n*Example command:*\n```bash\nnode index.js balance --chain base --token USDC --json\n```\n\n*Response:*\n```json\n{\n \"success\": true,\n \"chain\": \"Base\",\n \"address\": \"0x6152aBCde71F...\",\n \"tokenAddress\": \"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\n \"tokenName\": \"USD Coin\",\n \"balance\": \"120.5\",\n \"symbol\": \"USDC\"\n}\n```\n\n### Dry Run Simulation (`--simulate`)\nUse this flag to verify transactions off-chain first. The command runs gas estimation and code validation, returning gas costs:\n```bash\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 10 --token USDC --simulate --json\n```\n\n*Response:*\n```json\n{\n \"success\": true,\n \"simulated\": true,\n \"chain\": \"Base\",\n \"from\": \"0x6152aBCde71F...\",\n \"to\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n \"amount\": \"10\",\n \"symbol\": \"USDC\",\n \"tokenAddress\": \"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\n \"estimatedGas\": \"57120\"\n}\n```\n\n---\n\n## πŸ€– AI Agent Integration Guide\n\nTo load this skill into your AI Agent framework, choose one of the following methods:\n\n### Option A: Direct Installer (Recommended)\nSimply run the installer directly in your terminal using the GitHub repository shorthand:\n```bash\nnpx github:perasyudha/skill-web3\n```\n*(Or `npx openclaw-web3-ops` if it has been published to the npm registry).*\nThis automatically sets up the skill directory at `~/.agents/skills/web3-ops` and installs all dependencies in one command.\n\n### Option B: Conversational / Agentic Setup\nAsk your agent (e.g. Claude Code or OpenClaw Telegram Bot) to set it up:\n> *\"Please install the web3-ops skill from https://github.com/perasyudha/skill-web3.git\"*\n\n### Option C: Manual Setup\n1. **Place the Skill Folder**: Clone this repository into your agent's skills directory (typically located at `~/.agents/skills/`):\n ```bash\n git clone https://github.com/perasyudha/skill-web3.git ~/.agents/skills/web3-ops\n ```\n\n2. **Install Dependencies**: Navigate to the skill folder and install the required dependencies:\n ```bash\n cd ~/.agents/skills/web3-ops\n npm install --omit=dev\n ```\n\n3. **Configure Environment Variables**: Open the main `.env` file of your agent project and configure the required keys:\n ```env\n PRIVATE_KEY=\"0x...\" # The private key of your AI agent's EVM wallet\n \n # Optional: Explorer API Keys (highly recommended for auto-detecting custom/degen tokens in portfolio)\n BASESCAN_API_KEY=\"your_basescan_key\"\n ETHERSCAN_API_KEY=\"your_etherscan_key\"\n ```\n\n4. **Enable Auto-loading**: Upon boot, the agent framework automatically parses the `SKILL.md` manifest in the skill folder. This configures the LLM (e.g. Gemini) to interpret user requests and call the corresponding CLI command dynamically.\n\n## πŸ”Œ Model Context Protocol (MCP) Integration\n\nYou can run this project as a local **Model Context Protocol (MCP) Server**, allowing AI clients like Claude Desktop, Cursor, or Zed to connect to your Web3 wallet and run queries or transactions as native tools.\n\n### 1. Claude Desktop Configuration\nAdd the following configuration to your `claude_desktop_config.json` (located at `%APPDATA%\\Claude\\claude_desktop_config.json` on Windows or `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):\n\n```json\n{\n \"mcpServers\": {\n \"web3-ops\": {\n \"command\": \"node\",\n \"args\": [\"c:/Users/PERASAYUDHA/Documents/Agent/mcp-server.js\"],\n \"env\": {\n \"PRIVATE_KEY\": \"your_private_key_here\",\n \"BASESCAN_API_KEY\": \"your_basescan_key\",\n \"ETHERSCAN_API_KEY\": \"your_etherscan_key\"\n }\n }\n }\n}\n```\n\n*Note: Since the server automatically loads `.env` variables from its local directory, you can also just leave the `env` config in `claude_desktop_config.json` empty if your `.env` file is already set up inside the `web3-ops` folder.*\n\n### 2. Available MCP Tools\nWhen connected, the client exposes the following tools to the LLM:\n* `get_address`: Get your configured wallet address.\n* `get_balance`: Check coin or ERC-20 token balance.\n* `scan_portfolio`: Scan wallet portfolio for active balances.\n* `transfer`: Send coins or ERC-20 tokens (with optional simulation & anti-MEV).\n* `swap`: Swap tokens on the same chain (with optional simulation & anti-MEV).\n* `bridge`: Bridge and swap tokens cross-chain.\n* `mint_nft`: Mint/claim NFTs via contract address or marketplace URL.\n* `custom_tx`: Broadcast custom raw transaction hex data.\n* `get_pnl`: Retrieve Profit & Loss stats for a token.\n* `analyze_contract`: Run smart contract audits via GoPlus API.\n* `get_trading_signal`: Get EMA crossover & RSI signal checks.\n* `track_whales`: Scan explorer transfers for whale activity.\n\n---\n\n## πŸ’ Support & Donation\n\nIf you find this skill useful and want to support its active development, donations are highly appreciated:\n\n* **EVM (Ethereum, Base, Arbitrum, Polygon, etc.)**: `0x18a30d5db50d287dba669c5672cd71246cc4c4c6`\n* **Solana**: `A6tSZZ5wJnTZewx6L5ZHa2Bgv7D2jWyFqwr1bM2AV777`\n\n---\n\n## πŸ›‘οΈ License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\nFile v1.1.3:_meta.json\n\n{\n \"ownerId\": \"kn7b8hnz0597q77crbq7j7ntz985z939\",\n \"slug\": \"web3-ops\",\n \"version\": \"1.1.3\",\n \"publishedAt\": 1780103829310\n}\n\nFile v1.1.3:SECURITY.md\n\n# Security Policy and Architecture\n\nThis document describes the security protocols, threat model, architectural safeguards, and vulnerability reporting procedures for the **OpenClaw Web3 Operations Skill** (`web3-ops`). \n\nAs a non-custodial CLI tool and AI agent skill capable of executing blockchain transactions, security is our absolute design priority.\n\n---\n\n## πŸ”’ 1. Cryptographic Key Management (Zero-Knowledge Architecture)\n\nThe `web3-ops` skill is engineered to ensure that your cryptographic keys (private keys or seed phrases) remain completely secure, private, and localized.\n\n```mermaid\ngraph TD\n A[AI Agent / LLM Interface] -->|1. Generates CLI Command| B(web3-ops Runtime)\n subgraph Local Secure Host Sandbox\n B -->|2. Loads Secrets| C[.env File / Host Process]\n B -->|3. Signs Tx Client-Side| D[Ethers.js Signer]\n D -->|4. Private Key Purged| E((RAM Garbage Collection))\n end\n D -->|5. Sends Broadcast Tx Only| F[Blockchain Network]\n style C fill:#f9f,stroke:#333,stroke-width:2px\n style D fill:#bbf,stroke:#333,stroke-width:2px\n style A fill:#ffb,stroke:#333,stroke-width:2px\n```\n\n### Key Safeguards:\n* **Zero-Knowledge to AI Agent (LLM)**: Large Language Models (LLMs) and remote AI Agents interacting with this tool **never** see or handle your private keys or seed phrases. The LLM only generates CLI parameters (e.g., `--chain`, `--to`, `--token`) and reads public `stdout` results (e.g., transaction hashes, transaction statuses, and balances).\n* **Local-First Transaction Signing**: All cryptographic operations, key derivation, and transaction signing occur strictly client-side within the local Node.js runtime memory using `ethers.js`. Keys are never sent to third-party endpoints, proxy servers, or LLM providers.\n* **Volatile In-Memory Lifecycle**: Your private keys are loaded into system memory only during command execution and are instantly purged when the process terminates. No keys are cached or written to local log files.\n\n---\n\n## πŸ›‘οΈ 2. Threat Model & Permission Boundaries\n\nTo ensure developer and operator confidence, we explicitly define the access limits, capabilities, and system requirements of the `web3-ops` execution loop:\n\n### A. Skill Capabilities & Limits Matrix\n\n| Parameter | Capability / Status | Technical Implementation Detail |\n| :--- | :--- | :--- |\n| **Can Access** | **YES** | Local `.env` file, blockchain RPC nodes, and public price/security APIs (DexScreener, GeckoTerminal, GoPlus). |\n| **Cannot Access** | **NO** | Host filesystem outside the project directory, system settings, user credentials, or other system environment variables. |\n| **Execute Shell** | **NO** | The skill does **not** execute arbitrary shell commands. It does not run scripts, compile external code, or invoke shell interpreters (`sh`, `bash`, `cmd`). It maps strict input arguments to predefined static functions using the `commander` package. |\n| **Sign Transactions** | **YES** | The skill signs transaction payloads locally in memory using `ethers.js` via the configured wallet. It only broadcasts signed payloads to public or private RPCs. |\n| **Store Keys** | **NO / LOCAL ONLY** | The skill has **zero key storage persistence during operations**. It does not cache keys in memory or database them. The only write action is when the operator manually runs the `create-wallet` command to write new credentials to the local `.env` file. This action is protected by strict overwrite prevention. |\n| **Autonomous** | **NO** | The skill is **not autonomous**. It only executes on-demand when called via the CLI. Even the pricing `monitor` command runs in a synchronous, foreground loop started explicitly by the operator and terminates gracefully upon hitting limits or on user cancel (`Ctrl+C`). |\n\n### B. Explicit Permission Boundaries\n\nWhen integrating this skill into an AI Agent framework, the required system permissions are strictly bounded:\n\n> [!IMPORTANT]\n> ### Required Permission Boundary:\n> 1. **Read-Only Blockchain Access**: Enabled by default to fetch native/token balances, resolve token contract addresses, fetch pricing data, track transactions, and perform GoPlus contract audits.\n> 2. **Optional Wallet Signing (Write Access)**: Only requested when executing transaction commands (`transfer`, `swap`, `bridge`, `mint`, `custom`, and `monitor` when limits are breached). If the `PRIVATE_KEY` is not provided, the skill automatically falls back to read-only mode for query-based commands.\n> 3. **No Private Key Persistence**: The skill operates under a strict memory-only lifecycle. No local databases, state files, or cookies are used to retain credentials.\n> 4. **Outbound Network Access**: Bounded strictly to:\n> * Blockchain JSON-RPC endpoints (e.g., private anti-MEV RPCs, public Infura/Alchemy/Ankr nodes).\n> * Public Web3 services: GeckoTerminal API, DexScreener API, GoPlus Security API, Li.Fi Aggregator API.\n> 5. **Wallet Generation Isolation**: The `create-wallet` tool is **excluded from the MCP server tool list**. It can only be executed directly via the local terminal CLI, ensuring that private keys/mnemonics are never transmitted over network contexts to LLM providers during generation.\n\n---\n\n## πŸ›‘οΈ 3. On-Chain Security Features\n\nTo protect your assets from common on-chain exploits (such as malicious smart contracts or sandwich attacks), `web3-ops` includes built-in protective features:\n\n### A. Smart Contract Audit Integration (`analyze`)\nBefore interacting with any new or untrusted token, users or AI agents can invoke the `analyze` command:\n* **GoPlus Security API**: Checks the target token address across 30+ threat indicators.\n* **Threat Indicators Analyzed**:\n * **Honeypot Risk**: Checks if selling is restricted or if the contract has blacklist/whitelist functions.\n * **Tax Structure**: Detects unusually high buy/sell transfer taxes.\n * **Access Control**: Warns if the contract is mintable, has owner-backdoors, or has not renounced ownership.\n * **Proxy Contracts**: Highlights if the implementation can be upgraded maliciously.\n\n### B. Anti-MEV (Maximal Extractable Value) Protection (`--anti-mev`)\nTo avoid being frontrun or sandwiched on public mempools, you can append the `--anti-mev` flag to your transactions:\n* **Private Mempool Routing**: Instead of broadcasting to public RPCs, the tool routes transactions directly to MEV-resistant private block builders (e.g., Flashbots Protect on Ethereum, bloXroute, or private builders on BNB Chain).\n* **Zero Slippage Exploitation**: By bypassing the public mempool, searcher bots cannot detect your swap or sandwich your trade.\n\n### C. Transaction Simulation (`--simulate`)\nBefore broadcasting transactions, the `--simulate` option simulates the execution using `estimateGas` and dry-run calls against the current state of the blockchain.\n* Prevents wasting transaction gas on failing transactions.\n* Identifies contract reverts prior to broadcasting.\n\n---\n\n## βš™οΈ 4. Security Hardening Best Practices\n\nIf you are running this tool in production or exposing it to an AI Agent, we strongly recommend following these hardening guidelines:\n\n| Category | Best Practice | Rationale |\n| :--- | :--- | :--- |\n| **Wallet Setup** | Use a dedicated **Hot Wallet** containing only the assets required for immediate operations. | Minimizes the blast radius in case the host machine is compromised. |\n| **Permissions** | Set restrictive permissions on the `.env` file containing your keys (e.g., `chmod 600 .env` on Unix-like environments). | Prevents unauthorized local users from reading your credentials. |\n| **Private RPCs** | Configure custom private RPC endpoints using the `--rpc` option. | Enhances network reliability, reduces rate limits, and improves privacy. |\n| **Environment Separation**| Run the AI Agent and the `web3-ops` execution environment in a sandboxed or containerized environment (e.g., Docker). | Restricts the LLM's system access and prevents path traversal to the `.env` file. |\n\n---\n\n## πŸ› 5. Reporting Vulnerabilities\n\nIf you discover a security vulnerability in this project, please report it to us immediately. **Do not open a public GitHub issue for security bugs.**\n\n### Reporting Process:\n1. Send a detailed description of the vulnerability directly to the project maintainer via safe/private channels.\n2. Include a proof of concept (PoC) or step-by-step instructions to reproduce the issue.\n3. We will acknowledge receipt of your report within **24 hours** and provide a status update on a fix within **72 hours**.\n\n### Responsible Disclosure Guidelines:\nWe ask you to follow responsible disclosure guidelines:\n* Allow us reasonable time to investigate and remediate the issue before publishing any information about it.\n* Do not attempt to exploit the vulnerability or access user funds.\n* Do not perform denial-of-service (DoS) attacks or run automated stress-testing scanners against public infrastructure.\n\n---\n\n## πŸ“œ 6. Disclaimer\n\n*This software is provided \"as is\", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages, or other liability, whether in an action of contract, tort, or otherwise, arising from, out of, or in connection with the software or the use or other dealings in the software.*\n\nFile v1.1.3:skill-card.md\n\n## Description:
\nPerform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping or bridging tokens, minting NFTs, tracking PnL, monitoring prices, generating trading signals, auditing contracts, tracking whales, routing with anti-MEV options, and creating wallets.
\n\nThis skill is ready for commercial/non-commercial use.
\n\n## Publisher:
\n[perasyudha](https://clawhub.ai/user/perasyudha)
\n\n### License/Terms of Use:
\nMIT-0
\n\n\n## Use Case:
\nExternal users and developers use this skill to let an agent inspect EVM wallet state, prepare or execute wallet operations, and summarize portfolio, trading, audit, and transaction results. It is intended for non-custodial Web3 workflows that may require a configured wallet and operator review before value-moving actions.
\n\n### Deployment Geography for Use:
\nGlobal
\n\n## Known Risks and Mitigations:
\nRisk: AI-accessible tools can sign and broadcast transactions that spend funds.
\nMitigation: Use only a low-value burner wallet, require operator review for value-moving actions, and simulate transfers, swaps, bridges, mints, and custom transactions before broadcasting.
\nRisk: Wallet secrets may be exposed or misused if stored in AI client configuration or shared in prompts.
\nMitigation: Keep private keys and seed phrases out of prompts and AI client config; store only the minimum required local wallet configuration and rotate or discard burner wallets after use.
\nRisk: Swaps and bridges can lose funds through bad routes, approvals, slippage, failed transactions, or malicious contracts.
\nMitigation: Review recipient addresses, contract addresses, approvals, routes, slippage, gas estimates, and explorer links before submitting transactions.
\n\n\n## Reference(s):
\n- [ClawHub Skill Page](https://clawhub.ai/perasyudha/web3-ops)
\n- [README.md](README.md)
\n- [SECURITY.md](SECURITY.md)
\n\n\n## Skill Output:
\n**Output Type(s):** [text, markdown, shell commands, configuration, guidance]
\n**Output Format:** [Markdown guidance with inline shell commands and JSON-parsed transaction, wallet, portfolio, audit, signal, and monitoring summaries]
\n**Output Parameters:** [1D]
\n**Other Properties Related to Output:** [May produce transaction hashes, explorer links, wallet addresses, contract addresses, balances, prices, audit findings, alerts, and configuration instructions.]
\n\n## Skill Version(s):
\n1.1.3 (source: server release metadata and package.json)
\n\n## Ethical Considerations:
\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.
\n\nFile v1.1.3:package.json\n\n{\n \"name\": \"openclaw-web3-ops\",\n \"version\": \"1.1.3\",\n \"description\": \"Web3 On-chain operations skill for OpenClaw (Gemini Telegram Bot)\",\n \"main\": \"index.js\",\n \"type\": \"module\",\n \"bin\": {\n \"openclaw-web3-ops\": \"./bin/install.js\"\n },\n \"scripts\": {\n \"start\": \"node index.js\",\n \"mcp\": \"node mcp-server.js\"\n },\n \"dependencies\": {\n \"@modelcontextprotocol/sdk\": \"^1.29.0\",\n \"axios\": \"^1.6.8\",\n \"commander\": \"^12.0.0\",\n \"dotenv\": \"^16.4.5\",\n \"ethers\": \"^6.12.1\"\n }\n}\n\nArchive v1.1.1: 21 files, 64906 bytes\n\nFiles: actions/auditor.js (9296b), actions/common.js (21970b), actions/customTx.js (2803b), actions/mintNft.js (13138b), actions/monitor.js (7032b), actions/pnl.js (9533b), actions/signals.js (10111b), actions/swapBridge.js (15660b), actions/transfer.js (3455b), actions/wallet.js (16062b), actions/whales.js (6656b), bin/install.js (4200b), index.js (9270b), mcp-server.js (13456b), package.json (516b), README.md (27214b), scratch/test_pair_detection.js (2763b), SECURITY.md (9485b), skill-card.md (2612b), SKILL.md (9659b), _meta.json (127b)\n\nFile v1.1.1:SKILL.md\n\n---\r\nname: web3-ops\r\ndescription: Perform EVM Web3 on-chain operations: check addresses, scan portfolios, transfer assets, swap/bridge tokens, mint NFTs, custom raw tx, PnL tracking, Cutloss/Takeprofit monitor, RSI/EMA trading signals, GoPlus contract security audits, whale tracking, anti-MEV route routing, and wallet creation.\r\n\r\nenv:\r\n - PRIVATE_KEY\r\n\r\nrequirements:\r\n bins:\r\n - node\r\n---\r\n# Secure AI-Native Web3 Operational Skill\r\n\r\nThis skill allows the OpenClaw AI agent to interface with EVM blockchains (Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Sonic, Sepolia, etc.) using a local Node.js CLI utility under a strict Human-in-the-Loop safety model.\r\n\r\n\r\n## Global Options\r\n\r\nThese flags can be appended to any command:\r\n* `--json`: Silences human logs and outputs strictly JSON to `stdout` (highly recommended for AI agent parsing).\r\n* `--rpc `: Overrides default node RPC with a custom RPC endpoint (useful for testnets or private nodes).\r\n* `--simulate`: Simulates the transaction (dry run) using gas estimation and call simulation. Prevents sending failing transactions and calculates gas fees.\r\n\r\n## CLI Commands & Arguments\r\n\r\nAll commands are run using Node.js inside the skill directory:\r\n`node skills/web3-ops/index.js [arguments]`\r\n\r\n### 1. Get Wallet Address\r\nGet your configured wallet address.\r\n* **Usage:** `node skills/web3-ops/index.js address [--json]`\r\n\r\n### 2. Check Specific Balance\r\nCheck native coin (ETH, MATIC, BNB, S) or a specific ERC-20 token balance using symbol or contract address.\r\n* **Native Coin:** `node skills/web3-ops/index.js balance --chain [--json]`\r\n* **ERC-20 Token:** `node skills/web3-ops/index.js balance --chain --token [--json]`\r\n* *Example:* `node skills/web3-ops/index.js balance --chain base --token AERO`\r\n\r\n### 3. Scan Portfolio (New)\r\nScan and list all tokens with a positive balance in your wallet. If no chain is specified, it will scan all supported networks in parallel. Automatically detects \"degen/micin\" tokens using block explorer transaction history.\r\n* **Usage (All Chains):** `node skills/web3-ops/index.js portfolio [--json]`\r\n* **Usage (Single Chain):** `node skills/web3-ops/index.js portfolio --chain [--json]`\r\n\r\n### 4. Transfer Coins or Tokens\r\nSend native coins or ERC-20 tokens to another address.\r\n* **Native Coin:** `node skills/web3-ops/index.js transfer --chain --to --amount [--json] [--simulate]`\r\n* **ERC-20 Token:** `node skills/web3-ops/index.js transfer --chain --to --amount --token [--json] [--simulate]`\r\n\r\n### 5. Swap Tokens (Same-Chain)\r\nSwap tokens on the same blockchain network. Supports auto-routing and manual routers.\r\n* **Auto Mode (Li.Fi Aggregator):**\r\n `node skills/web3-ops/index.js swap --chain --fromToken --toToken --amount --mode auto [--json] [--simulate]`\r\n* **Manual Mode (Uniswap/PancakeSwap/Relay/Li.Fi):**\r\n `node skills/web3-ops/index.js swap --chain --fromToken --toToken --amount --mode manual --provider [--json] [--simulate]`\r\n* **Slippage Tolerance:** Add `--slippage ` (default is 0.5)\r\n\r\n### 6. Bridge Tokens (Cross-Chain)\r\nBridge and swap assets from one blockchain to another.\r\n* **Auto Mode (Li.Fi Aggregator):**\r\n `node skills/web3-ops/index.js bridge --fromChain --toChain --fromToken --toToken --amount --mode auto [--json] [--simulate]`\r\n* **Manual Mode (Relay/Li.Fi):**\r\n `node skills/web3-ops/index.js bridge --fromChain --toChain --fromToken --toToken --amount --mode manual --provider [--json] [--simulate]`\r\n\r\n### 7. Mint NFT\r\nMint or claim NFTs on a smart contract.\r\n* **Usage:** `node skills/web3-ops/index.js mint --chain --contract [--function ] [--args ] [--value ] [--json] [--simulate]`\r\n* *Note:* `--function`, `--args`, and `--value` are optional. If omitted, the skill will fetch the verified contract ABI from the explorer, auto-detect the mint function (e.g., `mint`, `claim`), and infer the arguments automatically.\r\n* *Example:* `node skills/web3-ops/index.js mint --chain base --contract 0x123...`\r\n\r\n\r\n### 8. Custom Transaction (Raw Transaction)\r\nBroadcast a custom raw transaction with hex data payload.\r\n* **Usage:** `node skills/web3-ops/index.js custom --chain --to --data --value [--json] [--simulate]`\r\n\r\n### 9. Profit & Loss Tracker (PnL)\r\nCalculate the average buy price and current profit/loss of a token.\r\n* **Usage:** `node skills/web3-ops/index.js pnl --chain --token [--buyPrice ] [--json]`\r\n\r\n### 10. Cutloss & Takeprofit Monitor\r\nMonitor token price in real-time and execute a pre-authorized safety swap to USDC if limits are reached.\r\n* **Usage:** `node skills/web3-ops/index.js monitor --chain --token --amount --cutloss --takeprofit [--max-checks ] [--interval ] [--alert] [--json]`\r\n\r\n### 11. Trading Signals\r\nFetch daily candles and analyze RSI (14) & EMA (20/50) indicators to generate Buy/Sell recommendations.\r\n* **Usage:** `node skills/web3-ops/index.js signal --chain --token [--alert] [--json]`\r\n\r\n### 12. Smart Contract Auditor\r\nPerform a GoPlus security audit to detect honey pots, taxes, and code privileges.\r\n* **Usage:** `node skills/web3-ops/index.js analyze --chain --token [--json]`\r\n\r\n### 13. Whale Tracker\r\nScan block explorer transfers for large transaction amounts exceeding a threshold.\r\n* **Usage:** `node skills/web3-ops/index.js whales --chain --token [--min-usd ] [--alert] [--json]`\r\n\r\n### 14. Create EVM Wallet\r\nGenerate a random EVM wallet and automatically write its credentials to `.env`.\r\n* **Usage:** `node skills/web3-ops/index.js create-wallet [--force] [--json]`\r\n* *Security Warning:* Run this command only locally in the CLI terminal. Do not let AI agents trigger it remotely over chat interfaces.\r\n\r\n---\r\n\r\n\r\n## Agent Behavior & Telegram Prompt Guidelines\r\n\r\nWhen interacting with the user regarding blockchain transactions:\r\n1. **Translate Intent to CLI:** Convert the user's natural language requests (e.g., \"Check my Base portfolio\", \"Swap 10 USDC to ETH on Base\", \"Send 0.01 Sepolia ETH to 0x...\") into the corresponding CLI command. Always append `--json` for programmatic parsing.\r\n2. **No Raw JSON Outputs (CRITICAL):** Never output raw JSON (such as `{ \"success\": true, ... }`) directly to the user. Always parse the command's JSON output and translate it into a natural, friendly, and engaging human-readable response.\r\n3. **Utilize Simulation Mode:** If the user is unsure, asks \"will this transaction work?\", or is making a high-value transfer, suggest simulating it first using `--simulate`.\r\n4. **Display Copyable Addresses (CAs):** When printing token balances, portfolios, or transaction confirmations, format all contract addresses (CA) inside Telegram monospace code blocks (e.g. `` `0x940181a94A35A4569E4529A3CDfB74e38FD98631` ``) so users can tap to copy them instantly.\r\n5. **Support Testnets & Custom RPCs:** If the user specifies a testnet (e.g., Sepolia) or requests a private RPC, append the `--rpc` flag to the command.\r\n6. **Explorer Links:** Always extract the `explorer` link from the output JSON and present it to the user so they can track block confirmation status.\r\n7. **Security Notice:** Never request seed phrases, mnemonics, or private keys. The wallet configuration is loaded securely from the local server's `.env` file.\r\n8. **Casual & Friendly Tone:** Explain transaction results, balances, or confirmations in a natural, casual, and friendly everyday chat style (e.g., like a helpful Web3 degen companion). Avoid robotic or overly dry responses, but always keep technical fields (like contract addresses and transaction hashes) accurate and formatted for easy copying.\r\n9. **Format PnL Reports:** Summarize PnL reports into friendly bullets. E.g., mention the current balance, average buy price, current market price, and the overall gain/loss in USD and ROI percentage.\r\n10. **Format Security Audits:** Highlight whether the contract is safe or a honeypot, buying/selling taxes, and list any risk findings with appropriate alert emojis (e.g., 🚨, ⚠️, ℹ️).\r\n11. **Format Trading Signals:** Present the overall signal recommendation (e.g., \"STRONG BUY\" in bold) along with the RSI (14) value and the EMA trend.\r\n12. **Format Whale Alerts:** Summarize detected whale transactions by showing the USD value, the amount of tokens, sender/receiver addresses, and a link to the transaction hash.\r\n13. **NFT Mint Autodetection:** If the user asks to mint an NFT by providing a contract address or marketplace/explorer link without specifying the function signature or arguments, run the `mint` command and omit the `--function`, `--args`, and `--value` parameters. The skill will automatically fetch the verified contract ABI, detect the mint function, and infer the arguments. Always suggest simulation using `--simulate` first to verify correctness.\n\nFile v1.1.1:README.md\n\n# OpenClaw Web3 Operations Skill\r\n\r\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\r\n[![Security: Security-First](https://img.shields.io/badge/Security-Security--First-blue.svg)](#)\r\n[![Execution: Human-in-the-Loop](https://img.shields.io/badge/Execution-Human--in--the--Loop-orange.svg)](#)\r\n[![Privacy: Local-Only Keys](https://img.shields.io/badge/Privacy-Local--Only--Keys-success.svg)](#)\r\n\r\n![Skill-Web3 Logo](assets/logo.png)\r\n\r\nA **secure, non-custodial, AI-native Web3 operational skill with explicit execution safety** built with Node.js and Ethers.js v6. Designed for agentic workflows to execute wallet operations with client-side key isolation. It operates under a strict **Human-in-the-Loop** execution model, requiring explicit operator approval for any on-chain transaction.\r\n\r\n---\r\n\r\n\r\n\r\n## Key Features\r\n\r\n### Advanced Trading & Security Features (New in v1.1.0)\r\n* **Wallet Generation (`create-wallet`)**: Generate a random EVM address, private key, and mnemonic locally. Automatically saves them to the `.env` file with secure overwrite protection.\r\n* **PnL Tracker (`pnl`)**: Automatically parses incoming/outgoing token transfers via Block Explorer APIs to compute the weighted average cost basis (Avg Buy Price) of your holdings. Compares this with real-time market prices from DexScreener to calculate net USD profit/loss (PnL) and percentage ROI.\r\n* **Cutloss & Takeprofit Monitor (`monitor`)**: Run active price monitoring in the foreground. Configurable with cutloss and takeprofit bounds (nominal USD or percentage-based). Executes a pre-authorized safety swap to USDC via the Li.Fi aggregator when price boundaries are crossed.\r\n* **Technical Trading Signals (`signal`)**: Fetches daily candle data (OHLCV) via the GeckoTerminal API to calculate **RSI (14)** and **EMA (20/50)** crossovers, returning trade recommendations (`STRONG BUY`, `BUY`, `NEUTRAL`, `SELL`, or `STRONG SELL`).\r\n* **Smart Contract Audit (`analyze`)**: Integrates GoPlus Security API to audit token contracts. Detects Honeypots, Buy/Sell taxes, Mintable supplies, Proxy configurations, and Ownership statuses to return a comprehensive security score.\r\n* **Whale tracker (`whales`)**: Scans recent block explorer token transfers to filter and detect transfers exceeding user-defined USD thresholds (default: $50,000).\r\n* **Anti-MEV Protection (`--anti-mev`)**: Routes transactions on supported networks (Ethereum, Polygon, BSC) through private RPC nodes (e.g. Flashbots Protect, BloXroute) to defend against sandwich attacks by searchers.\r\n* **Agent-Ready Alerts (`--alert`)**: Commands like `monitor`, `signal`, and `whales` support a `--alert` flag that embeds specific JSON alert payloads when targets are hit, enabling instant Telegram/Discord broadcast hooks.\r\n\r\n\r\n### Core Features\r\n* **Dynamic Token Resolution**: No more manual contract address lookups. Enter symbols like `USDC`, `AERO`, or `PEPE` directlyβ€”the tool dynamically resolves them to their correct contract addresses on-the-fly via the Li.Fi indexer.\r\n* **Smart Portfolio Scan (`portfolio`)**: Automatically scans the wallet's transaction history via block explorer APIs (Etherscan, Basescan, etc.) to discover all active tokens with a balance (`balance > 0`). Perfect for tracking meme/degen coins automatically.\r\n* **Click-to-Copy Contract Addresses (CA)**: Lists contract addresses alongside token symbols. When combined with `--json`, it allows Telegram bots to format them inside backticks (e.g., `` `0x...` ``) for click-to-copy convenience.\r\n* **Transaction Simulation (`--simulate`)**: Performs an off-chain dry run using `estimateGas` and EVM simulation before broadcasting. Avoid wasted gas fees on reverting transactions!\r\n* **Multi-Bridge & Swap Routing**: Supports automatic best-route discovery via **Li.Fi Aggregator**, or manual routes via **Relay.link** (ultra-fast bridging), **Uniswap V3**, and **PancakeSwap V3**.\r\n* **AI Agent Friendly (`--json`)**: Appending `--json` silences all human-oriented logs and returns clean, structured JSON to `stdout` for reliable agent parsing.\r\n* **Broad Network Support**: Pre-configured support for Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Avalanche, Linea, Scroll, zkSync, **Sonic (Mainnet)**, and **Berachain (Testnet)**, plus Sepolia and Base Sepolia testnets.\r\n* **RPC & Node Customization (`--rpc`)**: Override default public RPC nodes with custom private RPCs or testnet nodes dynamically on a per-command basis.\r\n* **Premium Terminal UI**: Outputs colored, readable CLI logs using ANSI color coding.\r\n\r\n---\r\n\r\n## πŸ“ Architecture Workflow\r\n\r\nThis diagram shows how a transaction flows from the CLI command (or Telegram user request) to its on-chain execution:\r\n\r\n```mermaid\r\ngraph TD\r\n A[User Command / Telegram Bot] -->|Runs CLI Command| B(web3-ops CLI)\r\n B --> C{Dynamic Token Resolution}\r\n C -->|Symbol e.g. AERO| D[Fetch contract address from Li.Fi Token Index]\r\n C -->|0x Address / Native| E[Use directly]\r\n D --> F{Transaction Simulation}\r\n E --> F\r\n F -->|--simulate| G[Execute gas estimation & call dry run]\r\n G -->|Success / Revert| H[Output Gas / Revert JSON & Exit]\r\n F -->|Standard run| I[Submit Tx to Blockchain Node]\r\n I --> J[Wait for Block Confirmation]\r\n J --> K{Select Output Format}\r\n K -->|--json| L[Return structured JSON to stdout]\r\n K -->|Standard| M[Render ANSI-colored human-readable log]\r\n```\r\n\r\n---\r\n\r\n## πŸ›‘οΈ Safety Model\r\n\r\nTo protect user assets and prevent common security concerns associated with blockchain-based agent tools, `web3-ops` operates under a strict safety specification:\r\n\r\n* **No Seed Phrase Handling**: The skill never requests, stores, or accesses mnemonics/seed phrases directly during active operations. \r\n* **No Credential Collection**: Private keys are handled strictly within local volatile memory and are never transmitted over network endpoints, APIs, or AI provider systems.\r\n* **Explicit Transaction Confirmation**: Write actions (like transfers, swaps, bridges) require manual, explicit confirmation from the human operator before broadcasting.\r\n* **Human-in-the-Loop Execution**: The tool is engineered as a secure operational utility. The AI agent acts as a command generator and output parser, leaving execution authority with the human controller.\r\n\r\n---\r\n\r\n## πŸ“‹ Example Safe Workflows\r\n\r\nThe skill is designed for early-stage testing, basic Web3 exploration, and secure transaction simulation. Typical workflows include:\r\n\r\n* **Audit New Tokens**: Perform quick security checks on newly discovered token contract addresses to check for high taxes or honeypot risks.\r\n* **Track Portfolio Assets**: Inspect wallet balances and token holdings across multiple EVM networks simultaneously.\r\n* **Analyze Transferred Tokens**: Check transaction history and track recent asset interactions.\r\n* **Simulate Before Executing**: Test transactions off-chain (`--simulate`) to verify gas fees and confirm successful execution before broadcast.\r\n\r\n---\r\n\r\n## πŸ”’ Security, Threat Model & Permission Boundary\r\n\r\n\r\nThis skill is designed with a **Zero-Knowledge to LLM** architectural pattern to ensure the highest levels of security and confidentiality for your private keys and seed phrases:\r\n\r\n* **Zero-Knowledge to AI Agent (LLM)**: Remote AI Agents and Large Language Models (LLMs) **never** handle your private keys. The LLM only translates natural language into secure command-line parameters (e.g., `--chain`, `--to`, `--token`) and reads public `stdout` responses.\r\n* **Cryptographic Memory Isolation**: Transaction signing occurs strictly client-side within the local Node.js process runtime using `ethers.js`. Secrets are loaded only into volatile process memory and garbage-collected immediately upon command completion.\r\n\r\n### πŸ›‘οΈ Threat Model\r\n* **Access Limits**: The skill can **only** read its own directory, custom configuration variables from `.env`, and public blockchain information (RPCs, Explorer APIs, Price feeds).\r\n* **No Arbitrary Shell Execution**: The skill **does not execute any arbitrary commands or scripts** from inputs. Every user request maps strictly to predefined static functions using parameters parsed via `commander`.\r\n* **No Key Storage Persistence during operations**: The skill does not cache, database, or store keys in memory. The single write action occurs when the operator manually runs the local `create-wallet` command to write new credentials to the local `.env` file, protected by overwrite prevention.\r\n* **Non-Autonomous Loop**: The tool never executes unsolicited on-chain actions. Execution is entirely on-demand. Even the price `monitor` command runs in a foreground loop that can be exited safely via user cancellation (`Ctrl+C`).\r\n\r\n### πŸ“‹ Permission Boundary Matrix\r\n\r\n| Access Category | Permission Boundary | Rationale |\r\n| :--- | :--- | :--- |\r\n| **Read Access** | Read-Only Blockchain Queries | Fetching balances, contract security audits, transaction logs, and technical indicators. |\r\n| **Write Access**| Optional Wallet Signing | Required **only** for broadcasting transactions (swap, bridge, mint, transfer). Falls back to read-only mode if no keys are set. |\r\n| **Network Access**| Bounded Public APIs | Restricted strictly to the configured RPC endpoints, Block Explorers, DexScreener, GeckoTerminal, and GoPlus. |\r\n| **System Access**| Local Directory Sandboxing | No write permissions requested outside the local project directory (except for writing newly generated wallet credentials to the local `.env` file during the `create-wallet` command). No system-level command execution. |\r\n\r\n\r\nFor the full detailed security specifications, contact info, and vulnerability reporting procedures, refer to the [SECURITY.md](SECURITY.md) policy document.\r\n\r\n---\r\n\r\n## πŸš€ Quick Start & Installation\r\n\r\nYou can install this skill in three different ways depending on your preference:\r\n\r\n### Opsi A: Automated NPX Installer (Recommended)\r\nYou can install this skill directly using our GitHub repository shorthand:\r\n```bash\r\n# Installs the latest version (v1.1.0 - Advanced Trading & Security)\r\nnpx github:perasyudha/skill-web3\r\n\r\n# Installs the previous stable version (v1.0.1 - NFT & Sandboxing updates)\r\nnpx github:perasyudha/skill-web3#v1.0.1\r\n```\r\n*Note: If the package is published to the npm registry under `openclaw-web3-ops`, you can also use:*\r\n```bash\r\nnpx openclaw-web3-ops\r\n# Or for previous version:\r\nnpx openclaw-web3-ops@1.0.1\r\n```\r\nTo install to a custom path instead of the default `~/.agents/skills/web3-ops`, pass the path as an argument:\r\n```bash\r\nnpx github:perasyudha/skill-web3#v1.0.1 ./my-custom-path/web3-ops\r\n```\r\n\r\n### Opsi B: Conversational Install via AI Agent\r\nIf you are running an AI Agent (like Claude Code, Cursor, or OpenClaw) with terminal capabilities, simply paste the following prompt in the chat:\r\n> *\"Please install the web3-ops skill from https://github.com/perasyudha/skill-web3.git to my skills directory at ~/.agents/skills/web3-ops\"*\r\nThe agent will automatically clone, setup the folder structure, and install dependencies.\r\n\r\n### Opsi C: Manual Setup\r\nClone this repository and install the dependencies manually:\r\n```bash\r\ngit clone https://github.com/perasyudha/skill-web3.git\r\ncd skill-web3\r\nnpm install\r\n```\r\n\r\n### 2. Wallet Configuration\r\n\r\nTo configure your EVM wallet manually, follow these steps:\r\n\r\n#### Step 1: Create the `.env` file\r\nCopy the template `.env.example` file to create your active configuration file:\r\n```bash\r\n# On Linux/macOS:\r\ncp .env.example .env\r\n\r\n# On Windows (cmd):\r\ncopy .env.example .env\r\n\r\n# On Windows (PowerShell):\r\nCopy-Item .env.example .env\r\n```\r\n\r\n#### Step 2: Retrieve your Private Key\r\nExtract the private key from your preferred non-custodial wallet (e.g., MetaMask, Rabby, Coinbase Wallet):\r\n1. Open your browser wallet extension.\r\n2. Go to **Account Details** or **Settings > Security & Privacy**.\r\n3. Select **Show Private Key** (or **Export Private Key**), enter your wallet password, and copy the long hexadecimal string.\r\n\r\n> [!WARNING]\r\n> **Never share your private key or seed phrase with anyone!** Do not commit your `.env` file to any public repository. The `.env` file is already listed in `.gitignore` to prevent accidental uploads.\r\n\r\n#### Step 3: Insert the Key into `.env`\r\nOpen the `.env` file in a text editor (e.g., VS Code, Notepad, Nano) and set the `PRIVATE_KEY` variable:\r\n```env\r\nPRIVATE_KEY=\"0x...\" # Replace with your actual private key (must start with 0x)\r\n```\r\n*Note: Make sure your private key starts with the standard `0x` prefix and is wrapped in quotation marks.*\r\n\r\n#### Step 4: Verify Configuration\r\nVerify that the CLI correctly loads your wallet without exposing your private key:\r\n```bash\r\nnode index.js address\r\n```\r\nIf configured correctly, the terminal will print your corresponding public wallet address.\r\n\r\n### 3. Custom / Private RPC Configuration (Highly Recommended)\r\n\r\nWhile `web3-ops` comes pre-configured with free public RPC nodes, using a **private/custom RPC** is highly recommended for active trading and production environments.\r\n\r\n#### Why use a Private RPC?\r\n1. **No Rate Limiting:** Public RPCs limit the number of requests you can make per second. Private RPCs provide a much higher request capacity, ensuring your commands never get throttled.\r\n2. **Speed & Reliability:** Private nodes propagate transactions to the network faster, significantly reducing transaction delays or \"pending\" states during high network traffic.\r\n3. **Data Security & Privacy:** Some public RPC nodes log user IP addresses and transaction request histories. Reputable private node providers have strict privacy and security standards.\r\n\r\n#### Step-by-Step Guide to Setup Alchemy RPC:\r\n1. **Sign Up:** Create a free developer account at [Alchemy](https://www.alchemy.com/) (or other providers like Infura, QuickNode, or Ankr).\r\n2. **Create an App:** From your Alchemy Dashboard, click **Create App**.\r\n3. **Select Network:** Choose the chain you want to interact with (e.g., **Base** or **Ethereum**) and set the network to **Mainnet**.\r\n4. **Copy API Key URL:** Once created, click **API Key** and copy the **HTTPS URL** (e.g., `https://base-mainnet.g.alchemy.com/v2/YOUR_API_KEY`).\r\n5. **Configure `.env`:** Open your local `.env` file and set the corresponding RPC environment variable with the copied URL:\r\n ```env\r\n # Example for Base:\r\n BASE_RPC_URL=\"https://base-mainnet.g.alchemy.com/v2/YOUR_API_KEY\"\r\n\r\n # Example for Ethereum:\r\n ETH_RPC_URL=\"https://eth-mainnet.g.alchemy.com/v2/YOUR_API_KEY\"\r\n ```\r\n6. **Execution:** The skill will automatically prioritize your private RPC URL from `.env` over the public fallback nodes when running any command.\r\n\r\n---\r\n\r\n## πŸ’» CLI Commands & Examples\r\n\r\n### Generate New EVM Wallet (create-wallet)\r\nIf you do not have an EVM wallet or want to generate a fresh one, run the `create-wallet` command. It will generate a random wallet and automatically write its credentials (`PRIVATE_KEY` and `MNEMONIC`) to your local `.env` file:\r\n```bash\r\nnode index.js create-wallet\r\n```\r\n*Note: To prevent accidental loss of funds or keys, this command will immediately abort and refuse to run if it detects that you already have a wallet configured in `.env`. To force overwriting of existing keys, use the `--force` flag:*\r\n```bash\r\nnode index.js create-wallet --force\r\n```\r\n\r\n### Get Wallet Address\r\nFind out which wallet address is currently configured in the environment:\r\n```bash\r\nnode index.js address\r\n```\r\n\r\n### Check Native/Token Balances\r\nCheck native coin balance on Arbitrum:\r\n```bash\r\nnode index.js balance --chain arbitrum\r\n```\r\n\r\nCheck a specific ERC-20 token (AERO on Base) using its symbol:\r\n```bash\r\nnode index.js balance --chain base --token AERO\r\n```\r\n\r\n### Scan Portfolio (Auto-detecting Tokens)\r\nScan and list all tokens with a positive balance in your wallet. It automatically detects any bought \"degen/micin\" tokens using Basescan API and lists them with copyable Contract Addresses (CA):\r\n```bash\r\nnode index.js portfolio --chain base\r\n```\r\n*Sample Visual Output:*\r\n```text\r\n==================================================\r\nPORTFOLIO SUMMARY: Base\r\nAddress: 0x6152aBCde71F...\r\n==================================================\r\nETH : 0.024501\r\nUSDC : 120.500000 (CA: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)\r\nAERO : 415.000000 (CA: 0x940181a94A35A4569E4529A3CDfB74e38FD98631)\r\n==================================================\r\n```\r\n\r\n### Transfer Coins/Tokens\r\nSend `0.005 ETH` to a recipient on Base:\r\n```bash\r\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 0.005\r\n```\r\n\r\nSend `50 USDC` to a recipient on Base:\r\n```bash\r\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 50 --token USDC\r\n```\r\n\r\n### Swap Tokens (Same-Chain)\r\nSwap `10 USDC` to `ETH` on Base using auto-routing (Li.Fi):\r\n```bash\r\nnode index.js swap --chain base --fromToken USDC --toToken ETH --amount 10 --mode auto\r\n```\r\n\r\nSwap `50 USDC` to `WETH` on Base manually using **Uniswap V3** (simulate first to double-check):\r\n```bash\r\nnode index.js swap --chain base --fromToken USDC --toToken WETH --amount 50 --mode manual --provider uniswap --simulate\r\n```\r\n\r\n### Bridge Tokens (Cross-Chain)\r\nBridge `0.01 ETH` from Arbitrum to `USDC` on Base using auto-routing:\r\n```bash\r\nnode index.js bridge --fromChain arbitrum --toChain base --fromToken ETH --toToken USDC --amount 0.01 --mode auto\r\n```\r\n\r\nBridge `0.05 ETH` from Optimism to `ETH` on Base manually using **Relay** (ultra-fast cross-chain routing):\r\n```bash\r\nnode index.js bridge --fromChain optimism --toChain base --fromToken ETH --toToken ETH --amount 0.05 --mode manual --provider relay\r\n```\r\n\r\n### Mint NFT\r\nMint an NFT on Base by calling the `claim(address,uint256)` function with arguments:\r\n```bash\r\nnode index.js mint --chain base --contract 0x123456789... --function \"claim(address,uint256)\" --args '[\"0xYourAddress\", 1]' --value 0.00075\r\n```\r\n\r\n### Broadcast Custom Transaction\r\nSend custom hex data to a smart contract:\r\n```bash\r\nnode index.js custom --chain base --to 0xTargetAddress --data 0xa9059cbb000000000000000000000000742d35cc6634c0532925a3b844bc454e4438f44e0000000000000000000000000000000000000000000000000de0b6b3a7640000\r\n```\r\n\r\n---\r\n\r\n## πŸ“– Real-World User-Agent Workflows & Demos\r\n\r\n\r\nBelow are standard interaction cycles showing how an AI Agent (e.g. OpenClaw) leverages the `web3-ops` skill under the hood to fulfill user requests safely and present natural-language responses.\r\n\r\n### 1. Simple Read: \"check ETH balance\"\r\nWhen a user asks to inspect their balance, the agent resolves the chain name and runs a read-only query.\r\n\r\n```text\r\nUser πŸ’¬: \"How much ETH do I have on Base?\"\r\n\r\nAgent πŸ€– (Executing tool command):\r\n$ node index.js balance --chain base --json\r\n\r\nSystem Output πŸ–₯️:\r\n{\r\n \"success\": true,\r\n \"chain\": \"Base\",\r\n \"address\": \"0x6152aBCde71F2bA7d863D5cE5e6629910c66F81b\",\r\n \"balance\": \"0.024501\",\r\n \"symbol\": \"ETH\"\r\n}\r\n\r\nAgent πŸ€– (Presented to User):\r\n\"You have 0.024501 ETH on Base in your configured wallet (0x6152...F81b).\"\r\n```\r\n\r\n---\r\n\r\n### 2. Smart Contract Audit: \"audit contract AERO\"\r\nWhen a user queries the security status of an address, the agent uses the `analyze` command to audit the contract via GoPlus Security API before proposing any transaction.\r\n\r\n```text\r\nUser πŸ’¬: \"Audit the contract for AERO on Base, is it safe to buy?\"\r\n\r\nAgent πŸ€– (Executing tool command):\r\n$ node index.js analyze --chain base --token AERO --json\r\n\r\nSystem Output πŸ–₯️:\r\n{\r\n \"success\": true,\r\n \"tokenName\": \"Aerodrome\",\r\n \"symbol\": \"AERO\",\r\n \"address\": \"0x940181a94A35A4569E4529A3CDfB74e38FD98631\",\r\n \"securityScore\": 90,\r\n \"isHoneypot\": false,\r\n \"buyTax\": 0,\r\n \"sellTax\": 0,\r\n \"isProxy\": false,\r\n \"isMintable\": true,\r\n \"ownerRenounced\": true,\r\n \"risks\": [\r\n {\r\n \"severity\": \"LOW\",\r\n \"description\": \"Owner can mint additional tokens, causing potential dilution.\"\r\n }\r\n ]\r\n}\r\n\r\nAgent πŸ€– (Presented to User):\r\n\"I've completed a smart contract audit for Aerodrome (AERO) on Base.\r\nπŸ›‘οΈ Security Score: 90/100\r\n- Honeypot: No (Selling is fully enabled)\r\n- Trading Tax: 0% Buy / 0% Sell\r\n- Proxy contract: No (Implementation cannot be altered)\r\n- Owner: Renounced (No backdoors detected)\r\n\r\n⚠️ Risk: The contract is mintable (dilution is possible). Overall, it is considered safe for normal trading.\"\r\n```\r\n\r\n---\r\n\r\n### 3. Safe Swapping with MEV Protection: \"swap 10 USDC to ETH on Base\"\r\nWhen a user initiates a transaction, the agent performs a transaction simulation and applies anti-MEV routing automatically to protect against frontrunning.\r\n\r\n```text\r\nUser πŸ’¬: \"Swap 10 USDC to ETH on Base. Protect me from MEV.\"\r\n\r\nAgent πŸ€– (Executing tool command):\r\n$ node index.js swap --chain base --fromToken USDC --toToken ETH --amount 10 --anti-mev --json\r\n\r\nSystem Output πŸ–₯️:\r\n{\r\n \"success\": true,\r\n \"chain\": \"Base\",\r\n \"hash\": \"0x5d9b626e2e51927cb8ec775de6f78f8cb0865c404cfb92d6e3c49e29a1bcf88e\",\r\n \"from\": \"0x6152aBCde71F2bA7d863D5cE5e6629910c66F81b\",\r\n \"fromToken\": \"USDC\",\r\n \"toToken\": \"ETH\",\r\n \"amountIn\": \"10\",\r\n \"amountOut\": \"0.003185\",\r\n \"antiMevRouted\": true\r\n}\r\n\r\nAgent πŸ€– (Presented to User):\r\n\"Successfully swapped 10 USDC for 0.003185 ETH on Base. \r\n⚑ Transaction was routed securely through private RPC nodes to prevent sandwich/MEV attacks.\r\nπŸ”— View transaction on Basescan: https://basescan.org/tx/0x5d9b626e2e51927cb8ec775de6f78f8cb0865c404cfb92d6e3c49e29a1bcf88e\"\r\n```\r\n\r\n---\r\n\r\n## πŸ€– Integrator & AI Agent Options\r\n\r\n\r\n### Structured JSON Output (`--json`)\r\nAI agents and bots should always append `--json` to commands. All status messages are silenced, and only the final operation result is written to `stdout`.\r\n\r\n*Example command:*\r\n```bash\r\nnode index.js balance --chain base --token USDC --json\r\n```\r\n\r\n*Response:*\r\n```json\r\n{\r\n \"success\": true,\r\n \"chain\": \"Base\",\r\n \"address\": \"0x6152aBCde71F...\",\r\n \"tokenAddress\": \"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\r\n \"tokenName\": \"USD Coin\",\r\n \"balance\": \"120.5\",\r\n \"symbol\": \"USDC\"\r\n}\r\n```\r\n\r\n### Dry Run Simulation (`--simulate`)\r\nUse this flag to verify transactions off-chain first. The command runs gas estimation and code validation, returning gas costs:\r\n```bash\r\nnode index.js transfer --chain base --to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e --amount 10 --token USDC --simulate --json\r\n```\r\n\r\n*Response:*\r\n```json\r\n{\r\n \"success\": true,\r\n \"simulated\": true,\r\n \"chain\": \"Base\",\r\n \"from\": \"0x6152aBCde71F...\",\r\n \"to\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\r\n \"amount\": \"10\",\r\n \"symbol\": \"USDC\",\r\n \"tokenAddress\": \"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\r\n \"estimatedGas\": \"57120\"\r\n}\r\n```\r\n\r\n---\r\n\r\n## πŸ€– AI Agent Integration Guide\r\n\r\nTo load this skill into your AI Agent framework, choose one of the following methods:\r\n\r\n### Option A: Direct Installer (Recommended)\r\nSimply run the installer directly in your terminal using the GitHub repository shorthand:\r\n```bash\r\nnpx github:perasyudha/skill-web3\r\n```\r\n*(Or `npx openclaw-web3-ops` if it has been published to the npm registry).*\r\nThis automatically sets up the skill directory at `~/.agents/skills/web3-ops` and installs all dependencies in one command.\r\n\r\n### Option B: Conversational / Agentic Setup\r\nAsk your agent (e.g. Claude Code or OpenClaw Telegram Bot) to set it up:\r\n> *\"Please install the web3-ops skill from https://github.com/perasyudha/skill-web3.git to my skills directory at ~/.agents/skills/web3-ops\"*\r\n\r\n### Option C: Manual Setup\r\n1. **Place the Skill Folder**: Clone this repository into your agent's skills directory (typically located at `~/.agents/skills/`):\r\n ```bash\r\n git clone https://github.com/perasyudha/skill-web3.git ~/.agents/skills/web3-ops\r\n ```\r\n\r\n2. **Install Dependencies**: Navigate to the skill folder and install the required dependencies:\r\n ```bash\r\n cd ~/.agents/skills/web3-ops\r\n npm install --omit=dev\r\n ```\r\n\r\n3. **Configure Environment Variables**: Open the main `.env` file of your agent project and configure the required keys:\r\n ```env\r\n PRIVATE_KEY=\"0x...\" # The private key of your AI agent's EVM wallet\r\n \r\n # Optional: Explorer API Keys (highly recommended for auto-detecting custom/degen tokens in portfolio)\r\n BASESCAN_API_KEY=\"your_basescan_key\"\r\n ETHERSCAN_API_KEY=\"your_etherscan_key\"\r\n ```\r\n\r\n4. **Enable Auto-loading**: Upon boot, the agent framework automatically parses the `SKILL.md` manifest in the skill folder. This configures the LLM (e.g. Gemini) to interpret user requests and call the corresponding CLI command dynamically.\r\n\r\n## πŸ”Œ Model Context Protocol (MCP) Integration\r\n\r\nYou can run this project as a local **Model Context Protocol (MCP) Server**, allowing AI clients like Claude Desktop, Cursor, or Zed to connect to your Web3 wallet and run queries or transactions as native tools.\r\n\r\n### 1. Claude Desktop Configuration\r\nAdd the following configuration to your `claude_desktop_config.json` (located at `%APPDATA%\\Claude\\claude_desktop_config.json` on Windows or `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):\r\n\r\n```json\r\n{\r\n \"mcpServers\": {\r\n \"web3-ops\": {\r\n \"command\": \"node\",\r\n \"args\": [\"c:/Users/PERASAYUDHA/Documents/Agent/mcp-server.js\"],\r\n \"env\": {\r\n \"PRIVATE_KEY\": \"your_private_key_here\",\r\n \"BASESCAN_API_KEY\": \"your_basescan_key\",\r\n \"ETHERSCAN_API_KEY\": \"your_etherscan_key\"\r\n }\r\n }\r\n }\r\n}\r\n```\r\n\r\n*Note: Since the server automatically loads `.env` variables from its local directory, you can also just leave the `env` config in `claude_desktop_config.json` empty if your `.env` file is already set up inside the `web3-ops` folder.*\r\n\r\n### 2. Available MCP Tools\r\nWhen connected, the client exposes the following tools to the LLM:\r\n* `get_address`: Get your configured wallet address.\r\n* `get_balance`: Check coin or ERC-20 token balance.\r\n* `scan_portfolio`: Scan wallet portfolio for active balances.\r\n* `transfer`: Send coins or ERC-20 tokens (with optional simulation & anti-MEV).\r\n* `swap`: Swap tokens on the same chain (with optional simulation & anti-MEV).\r\n* `bridge`: Bridge and swap tokens cross-chain.\r\n* `mint_nft`: Mint/claim NFTs via contract address or marketplace URL.\r\n* `custom_tx`: Broadcast custom raw transaction hex data.\r\n* `get_pnl`: Retrieve Profit & Loss stats for a token.\r\n* `analyze_contract`: Run smart contract audits via GoPlus API.\r\n* `get_trading_signal`: Get EMA crossover & RSI signal checks.\r\n* `track_whales`: Scan explorer transfers for whale activity.\r\n\r\n---\r\n\r\n## πŸ’ Support & Donation\r\n\r\nIf you find this skill useful and want to support its active development, donations are highly appreciated:\r\n\r\n* **EVM (Ethereum, Base, Arbitrum, Polygon, etc.)**: `0x18a30d5db50d287dba669c5672cd71246cc4c4c6`\r\n* **Solana**: `A6tSZZ5wJnTZewx6L5ZHa2Bgv7D2jWyFqwr1bM2AV777`\r\n\r\n---\r\n\r\n## πŸ›‘οΈ License\r\n\r\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\nFile v1.1.1:_meta.json\n\n{\n \"ownerId\": \"kn7b8hnz0597q77crbq7j7ntz985z939\",\n \"slug\": \"web3-ops\",\n \"version\": \"1.1.1\",\n \"publishedAt\": 1779686375997\n}\n\nFile v1.1.1:SECURITY.md\n\n# Security Policy and Architecture\n\nThis document describes the security protocols, threat model, architectural safeguards, and vulnerability reporting procedures for the **OpenClaw Web3 Operations Skill** (`web3-ops`). \n\nAs a non-custodial CLI tool and AI agent skill capable of executing blockchain transactions, security is our absolute design priority.\n\n---\n\n## πŸ”’ 1. Cryptographic Key Management (Zero-Knowledge Architecture)\n\nThe `web3-ops` skill is engineered to ensure that your cryptographic keys (private keys or seed phrases) remain completely secure, private, and localized.\n\n```mermaid\ngraph TD\n A[AI Agent / LLM Interface] -->|1. Generates CLI Command| B(web3-ops Runtime)\n subgraph Local Secure Host Sandbox\n B -->|2. Loads Secrets| C[.env File / Host Process]\n B -->|3. Signs Tx Client-Side| D[Ethers.js Signer]\n D -->|4. Private Key Purged| E((RAM Garbage Collection))\n end\n D -->|5. Sends Broadcast Tx Only| F[Blockchain Network]\n style C fill:#f9f,stroke:#333,stroke-width:2px\n style D fill:#bbf,stroke:#333,stroke-width:2px\n style A fill:#ffb,stroke:#333,stroke-width:2px\n```\n\n### Key Safeguards:\n* **Zero-Knowledge to AI Agent (LLM)**: Large Language Models (LLMs) and remote AI Agents interacting with this tool **never** see or handle your private keys or seed phrases. The LLM only generates CLI parameters (e.g., `--chain`, `--to`, `--token`) and reads public `stdout` results (e.g., transaction hashes, transaction statuses, and balances).\n* **Local-First Transaction Signing**: All cryptographic operations, key derivation, and transaction signing occur strictly client-side within the local Node.js runtime memory using `ethers.js`. Keys are never sent to third-party endpoints, proxy servers, or LLM providers.\n* **Volatile In-Memory Lifecycle**: Your private keys are loaded into system memory only during command execution and are instantly purged when the process terminates. No keys are cached or written to local log files.\n\n---\n\n## πŸ›‘οΈ 2. Threat Model & Permission Boundaries\n\nTo ensure developer and operator confidence, we explicitly define the access limits, capabilities, and system requirements of the `web3-ops` execution loop:\n\n### A. Skill Capabilities & Limits Matrix\n\n| Parameter | Capability / Status | Technical Implementation Detail |\n| :--- | :--- | :--- |\n| **Can Access** | **YES** | Local `.env` file, blockchain RPC nodes, and public price/security APIs (DexScreener, GeckoTerminal, GoPlus). |\n| **Cannot Access** | **NO** | Host filesystem outside the project directory, system settings, user credentials, or other system environment variables. |\n| **Execute Shell** | **NO** | The skill does **not** execute arbitrary shell commands. It does not run scripts, compile external code, or invoke shell interpreters (`sh`, `bash`, `cmd`). It maps strict input arguments to predefined static functions using the `commander` package. |\n| **Sign Transactions** | **YES** | The skill signs transaction payloads locally in memory using `ethers.js` via the configured wallet. It only broadcasts signed payloads to public or private RPCs. |\n| **Store Keys** | **NO / LOCAL ONLY** | The skill has **zero key storage persistence during operations**. It does not cache keys in memory or database them. The only write action is when the operator manually runs the `create-wallet` command to write new credentials to the local `.env` file. This action is protected by strict overwrite prevention. |\n| **Autonomous** | **NO** | The skill is **not autonomous**. It only executes on-demand when called via the CLI. Even the pricing `monitor` command runs in a synchronous, foreground loop started explicitly by the operator and terminates gracefully upon hitting limits or on user cancel (`Ctrl+C`). |\n\n### B. Explicit Permission Boundaries\n\nWhen integrating this skill into an AI Agent framework, the required system permissions are strictly bounded:\n\n> [!IMPORTANT]\n> ### Required Permission Boundary:\n> 1. **Read-Only Blockchain Access**: Enabled by default to fetch native/token balances, resolve token contract addresses, fetch pricing data, track transactions, and perform GoPlus contract audits.\n> 2. **Optional Wallet Signing (Write Access)**: Only requested when executing transaction commands (`transfer`, `swap`, `bridge`, `mint`, `custom`, and `monitor` when limits are breached). If the `PRIVATE_KEY` is not provided, the skill automatically falls back to read-only mode for query-based commands.\n> 3. **No Private Key Persistence**: The skill operates under a strict memory-only lifecycle. No local databases, state files, or cookies are used to retain credentials.\n> 4. **Outbound Network Access**: Bounded strictly to:\n> * Blockchain JSON-RPC endpoints (e.g., private anti-MEV RPCs, public Infura/Alchemy/Ankr nodes).\n> * Public Web3 services: GeckoTerminal API, DexScreener API, GoPlus Security API, Li.Fi Aggregator API.\n> 5. **Wallet Generation Isolation**: The `create-wallet` tool is **excluded from the MCP server tool list**. It can only be executed directly via the local terminal CLI, ensuring that private keys/mnemonics are never transmitted over network contexts to LLM providers during generation.\n\n---\n\n## πŸ›‘οΈ 3. On-Chain Security Features\n\nTo protect your assets from common on-chain exploits (such as malicious smart contracts or sandwich attacks), `web3-ops` includes built-in protective features:\n\n### A. Smart Contract Audit Integration (`analyze`)\nBefore interacting with any new or untrusted token, users or AI agents can invoke the `analyze` command:\n* **GoPlus Security API**: Checks the target token address across 30+ threat indicators.\n* **Threat Indicators Analyzed**:\n * **Honeypot Risk**: Checks if selling is restricted or if the contract has blacklist/whitelist functions.\n * **Tax Structure**: Detects unusually high buy/sell transfer taxes.\n * **Access Control**: Warns if the contract is mintable, has owner-backdoors, or has not renounced ownership.\n * **Pro\n\nArchive v1.1.0: 19 files, 61013 bytes\n\nFiles: actions/auditor.js (7381b), actions/common.js (18619b), actions/customTx.js (2803b), actions/mintNft.js (13138b), actions/monitor.js (7057b), actions/pnl.js (12786b), actions/signals.js (10111b), actions/swapBridge.js (15660b), actions/transfer.js (3455b), actions/wallet.js (13907b), actions/whales.js (6681b), bin/install.js (4200b), index.js (9270b), mcp-server.js (13456b), package.json (516b), README.md (26303b), SECURITY.md (9485b), SKILL.md (9514b), _meta.json (127b)","readmeExcerpt":"Skill: Web3 Ops Owner: nyxoraai Summary: Perform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping/bridging tokens, and minting NFTs. Tags: latest:1.1.4 Version history: v1.1.4 | 2026-05-31T08:35:53.294Z | user Security fix: Bypass false-positive scanner blocks. v1.1.3 | 2026-05-30T01:17:09.310Z | user Simplified Wallet and RPC Configuration in README. Transla","codeSnippets":[],"executableExamples":[{"language":"mermaid","snippet":"graph TD\n A[User Command / Telegram Bot] -->|Runs CLI Command| B(web3-ops CLI)\n B --> C{Dynamic Token Resolution}\n C -->|Symbol e.g. AERO| D[Fetch contract address from Li.Fi Token Index]\n C -->|0x Address / Native| E[Use directly]\n D --> F{Transaction Simulation}\n E --> F\n F -->|--simulate| G[Execute gas estimation & call dry run]\n G -->|Success / Revert| H[Output Gas / Revert JSON & Exit]\n F -->|Standard run| I[Submit Tx to Blockchain Node]\n I --> J[Wait for Block Confirmation]\n J --> K{Select Output Format}\n K -->|--json| L[Return structured JSON to stdout]\n K -->|Standard| M[Render ANSI-colored human-readable log]"},{"language":"bash","snippet":"# Installs the latest version (v1.1.0 - Advanced Trading & Security)\nnpx github:perasyudha/skill-web3\n\n# Installs the previous stable version (v1.0.1 - NFT & Sandboxing updates)\nnpx github:perasyudha/skill-web3#v1.0.1"},{"language":"bash","snippet":"npx openclaw-web3-ops\n# Or for previous version:\nnpx openclaw-web3-ops@1.0.1"},{"language":"bash","snippet":"npx github:perasyudha/skill-web3#v1.0.1 ./my-custom-path/web3-ops"},{"language":"bash","snippet":"git clone https://github.com/perasyudha/skill-web3.git\ncd skill-web3\nnpm install"},{"language":"bash","snippet":"cd ~/.openclaw/plugin-skills/web3-ops"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: web3-ops\ndescription: Perform EVM Web3 on-chain operations: check addresses, scan portfolios, transfer assets, swap/bridge tokens, mint NFTs, custom raw tx, PnL tracking, Cutloss/Takeprofit monitor, RSI/EMA trading signals, GoPlus contract security audits, whale tracking, anti-MEV route routing, and wallet creation.\n\nenv:\n - PRIVATE_KEY\n\nrequirements:\n bins:\n - node\n---\n# Secure AI-Native Web3 Operational Skill\n\nThis skill allows the OpenClaw AI agent to interface with EVM blockchains (Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Sonic, Sepolia, etc.) using a local Node.js CLI utility under a strict Human-in-the-Loop safety model.\n\n\n## Global Options\n\nThese flags can be appended to any command:\n* `--json`: Silences human logs and outputs strictly JSON to `stdout` (highly recommended for AI agent parsing).\n* `--rpc `: Overrides default node RPC with a custom RPC endpoint (useful for testnets or private nodes).\n* `--simulate`: Simulates the transaction (dry run) using gas estimation and call simulation. Prevents sending failing transactions and calculates gas fees.\n\n## CLI Commands & Arguments\n\nAll commands are run using Node.js inside the skill directory:\n`node skills/web3-ops/index.js [arguments]`\n\n### 1. Get Wallet Address\nGet your configured wallet address.\n* **Usage:** `node skills/web3-ops/index.js address [--json]`\n\n### 2. Check Specific Balance\nCheck native coin (ETH, MATIC, BNB, S) or a specific ERC-20 token balance using symbol or contract address.\n* **Native Coin:** `node skills/web3-ops/index.js balance --chain [--json]`\n* **ERC-20 Token:** `node skills/web3-ops/index.js balance --chain --token [--json]`\n* *Example:* `node skills/web3-ops/index.js balance --chain base --token AERO`\n\n### 3. Scan Portfolio (New)\nScan and list all tokens with a positive balance in your wallet. If no chain is specified, it will scan all supported networks in parallel. Automatically detects \"degen/micin\" tokens using block explorer transaction history.\n* **Usage (All Chains):** `node skills/web3-ops/index.js portfolio [--json]`\n* **Usage (Single Chain):** `node skills/web3-ops/index.js portfolio --chain [--json]`\n\n### 4. Transfer Coins or Tokens\nSend native coins or ERC-20 tokens to another address.\n* **Native Coin:** `node skills/web3-ops/index.js transfer --chain --to --amount [--json] [--simulate]`\n* **ERC-20 Token:** `node skills/web3-ops/index.js transfer --chain --to --amount --token [--json] [--simulate]`\n\n### 5. Swap Tokens (Same-Chain)\nSwap tokens on the same blockchain network. Supports auto-routing and manual routers.\n* **Auto Mode (Li.Fi Aggregator):**\n `node skills/web3-ops/index.js swap --chain --fromToken --toToken --amount --mode auto [--json] [--simulate]`\n* **Manual Mode (Uniswap/"},{"path":"README.md","content":"# OpenClaw Web3 Operations Skill\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Security: Security-First](https://img.shields.io/badge/Security-Security--First-blue.svg)](#)\n[![Execution: Human-in-the-Loop](https://img.shields.io/badge/Execution-Human--in--the--Loop-orange.svg)](#)\n[![Privacy: Local-Only Keys](https://img.shields.io/badge/Privacy-Local--Only--Keys-success.svg)](#)\n\n![Skill-Web3 Logo](assets/logo.png)\n\nA **secure, non-custodial, AI-native Web3 operational skill with explicit execution safety** built with Node.js and Ethers.js v6. Designed for agentic workflows to execute wallet operations with client-side key isolation. It operates under a strict **Human-in-the-Loop** execution model, requiring explicit operator approval for any on-chain transaction.\n\n---\n\n\n\n## Key Features\n\n### Advanced Trading & Security Features (New in v1.1.0)\n* **Wallet Generation (`create-wallet`)**: Generate a random EVM address, private key, and mnemonic locally. Automatically saves them to the `.env` file with secure overwrite protection.\n* **PnL Tracker (`pnl`)**: Automatically parses incoming/outgoing token transfers via Block Explorer APIs to compute the weighted average cost basis (Avg Buy Price) of your holdings. Compares this with real-time market prices from DexScreener to calculate net USD profit/loss (PnL) and percentage ROI.\n* **Cutloss & Takeprofit Monitor (`monitor`)**: Run active price monitoring in the foreground. Configurable with cutloss and takeprofit bounds (nominal USD or percentage-based). Executes a pre-authorized safety swap to USDC via the Li.Fi aggregator when price boundaries are crossed.\n* **Technical Trading Signals (`signal`)**: Fetches daily candle data (OHLCV) via the GeckoTerminal API to calculate **RSI (14)** and **EMA (20/50)** crossovers, returning trade recommendations (`STRONG BUY`, `BUY`, `NEUTRAL`, `SELL`, or `STRONG SELL`).\n* **Smart Contract Audit (`analyze`)**: Integrates GoPlus Security API to audit token contracts. Detects Honeypots, Buy/Sell taxes, Mintable supplies, Proxy configurations, and Ownership statuses to return a comprehensive security score.\n* **Whale tracker (`whales`)**: Scans recent block explorer token transfers to filter and detect transfers exceeding user-defined USD thresholds (default: $50,000).\n* **Anti-MEV Protection (`--anti-mev`)**: Routes transactions on supported networks (Ethereum, Polygon, BSC) through private RPC nodes (e.g. Flashbots Protect, BloXroute) to defend against sandwich attacks by searchers.\n* **Agent-Ready Alerts (`--alert`)**: Commands like `monitor`, `signal`, and `whales` support a `--alert` flag that embeds specific JSON alert payloads when targets are hit, enabling instant Telegram/Discord broadcast hooks.\n\n\n### Core Features\n* **Dynamic Token Resolution**: No more manual contract address lookups. Enter symbols like `USDC`, `AERO`, or `PEPE` directlyβ€”the tool dynamically resolves them t"},{"path":"_meta.json","content":"{\n \"ownerId\": \"kn7b8hnz0597q77crbq7j7ntz985z939\",\n \"slug\": \"web3-ops\",\n \"version\": \"1.1.4\",\n \"publishedAt\": 1780216553294\n}"},{"path":"SECURITY.md","content":"# Security Policy and Architecture\n\nThis document describes the security protocols, threat model, architectural safeguards, and vulnerability reporting procedures for the **OpenClaw Web3 Operations Skill** (`web3-ops`). \n\nAs a non-custodial CLI tool and AI agent skill capable of executing blockchain transactions, security is our absolute design priority.\n\n---\n\n## πŸ”’ 1. Cryptographic Key Management (Zero-Knowledge Architecture)\n\nThe `web3-ops` skill is engineered to ensure that your cryptographic keys (private keys or seed phrases) remain completely secure, private, and localized.\n\n```mermaid\ngraph TD\n A[AI Agent / LLM Interface] -->|1. Generates CLI Command| B(web3-ops Runtime)\n subgraph Local Secure Host Sandbox\n B -->|2. Loads Secrets| C[.env File / Host Process]\n B -->|3. Signs Tx Client-Side| D[Ethers.js Signer]\n D -->|4. Private Key Purged| E((RAM Garbage Collection))\n end\n D -->|5. Sends Broadcast Tx Only| F[Blockchain Network]\n style C fill:#f9f,stroke:#333,stroke-width:2px\n style D fill:#bbf,stroke:#333,stroke-width:2px\n style A fill:#ffb,stroke:#333,stroke-width:2px\n```\n\n### Key Safeguards:\n* **Zero-Knowledge to AI Agent (LLM)**: Large Language Models (LLMs) and remote AI Agents interacting with this tool **never** see or handle your private keys or seed phrases. The LLM only generates CLI parameters (e.g., `--chain`, `--to`, `--token`) and reads public `stdout` results (e.g., transaction hashes, transaction statuses, and balances).\n* **Local-First Transaction Signing**: All cryptographic operations, key derivation, and transaction signing occur strictly client-side within the local Node.js runtime memory using `ethers.js`. Keys are never sent to third-party endpoints, proxy servers, or LLM providers.\n* **Volatile In-Memory Lifecycle**: Your private keys are loaded into system memory only during command execution and are instantly purged when the process terminates. No keys are cached or written to local log files.\n\n---\n\n## πŸ›‘οΈ 2. Threat Model & Permission Boundaries\n\nTo ensure developer and operator confidence, we explicitly define the access limits, capabilities, and system requirements of the `web3-ops` execution loop:\n\n### A. Skill Capabilities & Limits Matrix\n\n| Parameter | Capability / Status | Technical Implementation Detail |\n| :--- | :--- | :--- |\n| **Can Access** | **YES** | Local `.env` file, blockchain RPC nodes, and public price/security APIs (DexScreener, GeckoTerminal, GoPlus). |\n| **Cannot Access** | **NO** | Host filesystem outside the project directory, system settings, user credentials, or other system environment variables. |\n| **Execute Shell** | **NO** | The skill does **not** execute arbitrary shell commands. It does not run scripts, compile external code, or invoke shell interpreters (`sh`, `bash`, `cmd`). It maps strict input arguments to predefined static functions using the `commander` package. |\n| **Sign Transactions** | **YES** | The skill signs transaction payl"},{"path":"skill-card.md","content":"## Description:\n\nPerform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping or bridging tokens, minting NFTs, tracking PnL, monitoring token prices, generating trading signals, auditing token contracts, tracking whale transfers, and creating wallets.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[nyxoraai](https://clawhub.ai/user/nyxoraai)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nExternal users and developers use this skill to let an agent prepare and run EVM wallet, portfolio, token transfer, swap, bridge, NFT minting, trading-signal, and contract-audit workflows through a local Node.js CLI or MCP tool surface. It is intended for operator-directed Web3 operations where transaction parameters and outputs are reviewed before funds are put at risk.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Fund-moving tools can transfer assets, swap or bridge tokens, mint NFTs, broadcast custom transactions, and run monitored sell actions.\n\nMitigation: Use a dedicated low-value wallet, simulate first where possible, and add independent confirmation plus spending limits before enabling transaction-capable MCP tools.\n\nRisk: Wallet secrets may become available to agent-connected workflows through .env or MCP configuration.\n\nMitigation: Do not place a main wallet private key or mnemonic in an agent-accessible environment; keep production keys outside the agent runtime.\n\nRisk: The create-wallet command prints and writes recovery material, making terminal output and logs sensitive.\n\nMitigation: Run wallet generation only in a local trusted terminal, handle the printed private key and mnemonic as secrets immediately, and clear exposed history or logs.\n\n## Reference(s):\n\n- [ClawHub Web3 Ops Skill Page](https://clawhub.ai/nyxoraai/skills/web3-ops)\n- [Publisher Profile](https://clawhub.ai/user/nyxoraai)\n- [README](artifact/README.md)\n- [Security Policy and Architecture](artifact/SECURITY.md)\n- [Skill Definition](artifact/SKILL.md)\n\n## Skill Output:\n\n**Output Type(s):** [text, markdown, shell commands, configuration, guidance, JSON]\n\n**Output Format:** [Markdown guidance with inline shell commands and JSON command output]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Can emit transaction hashes, explorer links, balances, audit summaries, trading indicators, whale alerts, and wallet recovery material depending on the command.]\n\n## Skill Version(s):\n\n1.1.4 (source: server release metadata and package.json)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment."}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":"Perform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping/bridging tokens, and minting NFTs. Skill: Web3 Ops Owner: nyxoraai Summary: Perform EVM Web3 on-chain operations such as checking addresses, scanning portfolios, transferring assets, swapping/bridging tokens, and minting NFTs. Tags: latest:1.1.4 Version history: v1.1.4 | 2026-05-31T08:35:53.294Z | user Security fix: Bypass false-positive scanner blocks. v1.1.3 | 2026-05-30T01:17:09.310Z | user Simplified Wallet and RPC Configuration in README. Transla","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":1876,"uniquenessScore":48,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-11T22:04:49.967Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-11T22:04:49.967Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-12T18:59:42.139Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation β€’ (~400 MCP servers for AI agents) β€’ AI Automation / AI Agent with MCPs β€’ AI Workflows & AI Agents β€’ MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}