openclaw-agent-wallet
Plan Spending Controls for Agent Wallets
Autonomous agents need spending limits and clear approval rules before handling funds. This public guide outlines wallet controls for planning, but does not include implementation files.
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
Review the Skillstore skill "openclaw-agent-wallet" from https://skillstore.io/skills/nexaiguy-openclaw-agent-wallet.md and its manifest at https://skillstore.io/api/skills/nexaiguy-openclaw-agent-wallet/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「openclaw-agent-wallet」を使用しています。 Propose a $50 daily cap and require approval above $10.
期待される結果:
- Proposed daily spending cap: $50.
- Proposed approval rule: payments above $10 require human approval.
- Status: planning only; no wallet configuration or transaction was executed.
「openclaw-agent-wallet」を使用しています。 Can this folder enforce wallet limits without other components?
期待される結果:
- No. This folder contains a public guide, not the policy engine or integration templates.
- A separate signer and a verified implementation are required.
- The described local queues are not distributed, and the policy assumes one currency.
「openclaw-agent-wallet」を使用しています。 Does WALLET_SIGNER_URL mean the signer is air-gapped?
期待される結果:
No. A signer URL identifies an external service. It does not prove offline isolation, authenticated access, or enforced spending controls.
セキュリティ監査
中リスクAll ten static detections are false positives involving Markdown, attribution links, or protective discussion of private keys. The guide mischaracterizes URL-based external signing as air-gapped, without demonstrating offline isolation. No evidence found of executable payloads, credential collection, exfiltration, or prompt injection in the reviewed file.
確認済みのセキュリティ上の懸念 (1)
リスク要因
⚙️ 外部コマンド (2)
🌐 ネットワークアクセス (2)
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/nexaiguy-openclaw-agent-wallet/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/nexaiguy-openclaw-agent-wallet?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/nexaiguy-openclaw-agent-wallet?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nexaiguy-openclaw-agent-wallet/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/nexaiguy-openclaw-agent-wallet.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
nexaiguy. (2026). openclaw-agent-wallet security audit report (audit version 1) [Author version 1.2]. Skillstore. https://skillstore.io/skills/nexaiguy-openclaw-agent-wallet/audits/1BibTeX形式の引用
@techreport{nexaiguy-nexaiguy-openclaw-agent-wallet-2026,
author = {nexaiguy},
title = {openclaw-agent-wallet security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/nexaiguy-openclaw-agent-wallet/audits/1},
note = {Author version 1.2}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "openclaw-agent-wallet security audit report (audit version 1)"
version: "1.2"
type: report
authors:
- name: "nexaiguy"
date-released: "2026-11-02"
url: "https://skillstore.io/skills/nexaiguy-openclaw-agent-wallet/audits/1"
identifiers:
- type: other
value: "skillstore:nexaiguy-openclaw-agent-wallet:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中作成できるもの
Specify Agent Spending Policies
Draft daily budgets and approval thresholds before integrating an agent with a separately implemented wallet service.
Review Wallet Custody Boundaries
Identify signer isolation assumptions and distinguish documented controls from protections that require implementation evidence.
Define Payment Approval Requirements
Plan which payments require human review and which events should appear in the payment audit trail.
これらのプロンプトを試す
Summarize the documented wallet controls and identify which implementation files are absent. Do not claim that any controls are active.
Draft a plain-language policy with a $50 daily cap and approval above $10. Mark it as a proposal, not an installed configuration.
Outline approval and audit requirements for high-value payments using this guide. Identify limitations of local queues and single-currency policies.
Review the external signer claims. Explain why a signer URL does not prove air-gapped isolation. List implementation evidence needed before using real funds.
ベストプラクティス
- Keep private keys outside agent prompts and environments; verify the separately deployed signer before connecting funds.
- Treat guide examples as proposals until a tested implementation enforces spending limits and approvals.
- Verify signer authorization and audit integrity independently before relying on the documented security claims.
回避
- Assuming the documentation alone installs or enforces wallet controls.
- Treating a remote signer URL as proof of air-gapped isolation.
- Treating an append-only local log as tamper-proof without independently verified protections.