Get the FREE Ultimate OpenClaw Setup Guide →
v

Agent Wallet

Flagged

@voltagemonke

{"isSafe":false,"isSuspicious":true,"riskLevel":"high","findings":[{"category":"data_exfiltration","severity":"high","description":"Seed phrase is displayed in plaintext to the user during wallet creation, creating a risk of leakage via chat history, logs, or screenshots.","evidence":"Seed Phrase:\n┌────────────────────────────────────────────┐\n│ word1 word2 word3 word4 word5 word6 │\n│ word7 word8 word9 word10 word11 word12 │\n└────────────────────────────────────────────┘"},{"category":"data_exfiltration","severity":"high","description":"Docs instruct storing the seed phrase in an environment variable WALLET_SEED_PHRASE in .env, which could be committed to source control or exposed in process environment and logs.","evidence":"Environment:\\nWALLET_SEED_PHRASE=\"your twelve word seed phrase goes here\"\\n...\\nAdd to .env:\\nWALLET_SEED_PHRASE=\"word1 word2 word3 ...\""},{"category":"prompt_injection","severity":"low","description":"No explicit prompt-injection patterns are present, but the dangerous practice of exposing seed material in outputs could be exploited via prompts to reveal secrets if logs or UI history are compromised.","evidence":"Not explicitly shown in code, but seed exposure enables social-engineering risk."}],"summary":"The skill defines a multi-chain wallet and includes seed handling that prints the seed phrase to the user and recommends storing it in an environment variable. The main safety issue is exposing the seed phrase in plaintext and encouraging insecure storage (env var), which could lead to total wallet compromise if logs, chat histories, or repository files are exposed. Recommendations: never display seed phrases in outputs; avoid embedding secrets in logs or .env; use secure vaults or ephemeral memory for seed handling; provide verification that does not reveal seeds (e.g., address verification, checksum, or encrypted storage)."}

npx machina-cli add skill @voltagemonke/agent-wallet-usdc --openclaw
Files (1)
SKILL.md
5.3 KB

AgentWallet

Multi-chain wallet skill for AI agents. One seed phrase, all chains.

Quick Reference

CommandExample
Create wallet"Create a new wallet"
Show addresses"Show my addresses" / "What's my wallet?"
Check balance"Check my balance" / "How much USDC do I have?"
Transfer"Send 10 USDC to 0x..." / "Transfer 5 SOL to ..."
Bridge"Bridge 10 USDC from Base to Solana"
Chain info"What chains are supported?"

Setup

New Wallet

User: "Create a new wallet"

Generates BIP-39 seed phrase, derives addresses for all chains. Shows seed ONCE with security warning.

Import Existing Wallet

User: "Import my wallet"

Response: "Add your seed phrase to .env as WALLET_SEED_PHRASE, then say 'Show my addresses' to verify."

No seed phrases in chat for imports - security first.

Environment

# Required for wallet operations
WALLET_SEED_PHRASE="your twelve word seed phrase goes here"

# Optional
NETWORK=testnet          # testnet (default) or mainnet
SOLANA_RPC=              # Custom Solana RPC (defaults to public)
BASE_RPC=                # Custom Base RPC (defaults to public)
ETH_RPC=                 # Custom Ethereum RPC (defaults to public)

Commands

Create Wallet

Run: node scripts/wallet.js create

Output format:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔐 NEW WALLET GENERATED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚠️  CRITICAL: Save this seed phrase securely!
    It will NOT be shown again.
    Anyone with this phrase can access your funds.

Seed Phrase:
┌────────────────────────────────────────────┐
│ word1 word2 word3 word4 word5 word6        │
│ word7 word8 word9 word10 word11 word12     │
└────────────────────────────────────────────┘

Your Addresses:
├─ Solana:   7xK9...mP4q
├─ Base:     0x7a3B...4f2E
└─ Ethereum: 0x7a3B...4f2E (same as Base)

Add to .env:
WALLET_SEED_PHRASE="word1 word2 word3 ..."

Network: TESTNET
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Show Addresses

Run: node scripts/wallet.js addresses

Shows derived addresses without exposing seed.

Check Balance

Run: node scripts/wallet.js balance [chain]

  • node scripts/wallet.js balance - All chains
  • node scripts/wallet.js balance solana - Solana only
  • node scripts/wallet.js balance base - Base only

Output includes native token + USDC balance per chain.

Transfer

Run: node scripts/wallet.js transfer <chain> <token> <amount> <recipient>

Examples:

  • node scripts/wallet.js transfer solana USDC 10 7xK9fR2...
  • node scripts/wallet.js transfer base ETH 0.01 0x7a3B...
  • node scripts/wallet.js transfer solana SOL 0.5 7xK9fR2...

Supported tokens per chain:

  • Solana: SOL, USDC
  • Base: ETH, USDC
  • Ethereum: ETH, USDC

Bridge (Cross-Chain)

Run: node scripts/wallet.js bridge <from-chain> <to-chain> <amount>

Bridges USDC between chains using Circle CCTP V2.

Examples:

  • node scripts/wallet.js bridge base solana 10 - Bridge 10 USDC from Base to Solana
  • node scripts/wallet.js bridge ethereum base 50 - Bridge 50 USDC from Ethereum to Base
  • node scripts/wallet.js bridge solana ethereum 25 - Bridge 25 USDC from Solana to Ethereum

Note: Bridging takes 1-5 minutes (burn → attestation → mint). Requires USDC on source chain plus native tokens for gas.

Chain Info

Run: node scripts/wallet.js chains

Lists supported chains, networks, and USDC contract addresses.

Derivation Paths

All chains derive from single BIP-39 seed:

ChainPathStandard
Solanam/44'/501'/0'/0'Solana/Phantom
EVM (Base/Eth)m/44'/60'/0'/0/0BIP-44 Ethereum

EVM chains share the same address (same derivation path).

Security Model

  • One seed per agent - Each agent instance isolated
  • Seed shown once - Only at creation, never logged
  • Memory only - Private keys derived on-demand, never persisted
  • No chat import - Seeds added via .env only (except generation)

Error Handling

ErrorCauseFix
"WALLET_SEED_PHRASE not set"Missing env varAdd seed to .env
"Invalid seed phrase"Wrong formatMust be 12 or 24 words
"Insufficient balance"Not enough fundsCheck balance first
"Invalid address"Wrong formatVerify recipient address

Chain References

For RPC endpoints, USDC addresses, and chain-specific details, see references/chains.md.

Source

git clone https://clawhub.ai/voltagemonke/agent-wallet-usdcView on GitHub

Overview

Agent Wallet enables AI agents to manage wallets across Solana, Base, and Ethereum. It supports creating wallets, checking balances (native + USDC), transferring tokens, and bridging USDC cross-chain, all from a single seed phrase. This simplifies payments and fund management for autonomous agents.

How This Skill Works

The skill derives addresses for all supported chains from a single BIP-39 seed phrase. Through node-based commands, agents can create a wallet, view addresses, check balances, transfer tokens (USDC and native), and bridge USDC between chains using Circle CCTP V2. Bridging takes 1–5 minutes and requires sufficient native gas on the source chain.

When to Use It

  • An agent needs to send or receive payments across chains (Solana, Base, Ethereum).
  • An agent must verify available funds before initiating transfers or bridges.
  • An agent handles cross-chain asset movement (USDC) between chains.
  • An agent initializes a new wallet or imports an existing one for unified control.
  • An agent wants to review supported chains and USDC contract addresses.

Quick Start

  1. Step 1: Run node scripts/wallet.js create
  2. Step 2: Run node scripts/wallet.js addresses
  3. Step 3: Run node scripts/wallet.js balance

Best Practices

  • Never share or expose seed phrases; store WALLET_SEED_PHRASE securely in .env.
  • Always verify addresses with Show Addresses before sending funds.
  • Check balances on all relevant chains before initiating transfers.
  • Test wallet operations on a testnet (NETWORK=testnet) before mainnet moves.
  • Bridge operations require USDC on the source chain plus native gas tokens; plan for potential 1–5 minute latency.

Example Use Cases

  • Create a new wallet, then verify addresses with Show Addresses to confirm the derived Solana/Base/Ethereum addresses.
  • Check balances across all chains to see native tokens and USDC holdings before a payment.
  • Transfer 10 USDC from Solana to a recipient on Solana or to Base/Ethereum as needed.
  • Bridge 25 USDC from Solana to Ethereum using the bridge command and monitor the 1–5 minute process.
  • List supported chains and USDC contract addresses to plan cross-chain activity.

Frequently Asked Questions

Add this skill to your agents
Sponsor this space

Reach thousands of developers