ClawHub

Zerion Api

v1.0.5

Query real-time crypto wallet portfolios, transactions, DeFi positions, token prices, NFTs, and gas fees across EVM chains and Solana via Zerion's MCP API.

⭐ 7· 1.9k·1 current·1 all-time
by@abishekdharshan
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
The name, README, package.json, and SKILL.md consistently describe a Zerion MCP-based crypto wallet data skill (portfolio, tx history, prices, NFTs, gas). The functionality requested (querying Zerion's MCP server) is coherent with the skill's stated purpose.
✓
Instruction Scope
SKILL.md gives narrowly scoped runtime instructions: call Zerion's MCP endpoint, configure an API key in MCP settings, and run wallet/chain queries. It does not instruct the agent to read unrelated files, scan local system data, or exfiltrate arbitrary information.
✓
Install Mechanism
This is an instruction-only skill with no install spec or code to run; that is low-risk. README suggests an optional 'npx clawhub install' command, but there is no install script included in the package itself.
!
Credentials
SKILL.md clearly states 'API key required' and shows how to add it to MCP configuration, but the registry metadata lists no required environment variables or primary credential. The skill will need a Zerion API key to function; the metadata omission is an inconsistency that could lead to misconfiguration or accidental exposure of credentials.
✓
Persistence & Privilege
The skill is not marked 'always' and does not request persistent system privileges. It appears to operate via remote HTTP calls to Zerion's MCP server only; autonomous invocation is allowed (platform default) but not combined with elevated permissions.
What to consider before installing
What to check before installing: (1) Confirm the official source — the registry metadata lists no homepage/source, but README references an author and an npx clawhub install path; verify that this package is from Zerion or a trusted maintainer. (2) The SKILL.md requires a Zerion API key but the package metadata doesn't declare any required credentials — don't paste API keys into an unverified skill. Configure the API key in your MCP config and ensure the MCP endpoint (https://developers.zerion.io/mcp) is the only external endpoint being used. (3) Review MCP configuration and any logs to ensure the skill doesn't forward your API key or query results to other endpoints. (4) If you need higher assurance, request that the publisher add explicit requires.env/primary credential metadata, provide a canonical homepage/repository, or publish an install spec from a trusted release host. These actions would raise confidence that the skill is what it claims to be.

Like a lobster shell, security has layers — review code before you run it.

blockchainvk970ap8w731a076ghgxr5jkp7h80g1brcryptovk970ap8w731a076ghgxr5jkp7h80g1brdefivk970ap8w731a076ghgxr5jkp7h80g1brevmvk970ap8w731a076ghgxr5jkp7h80g1brlatestvk970k7hrddb2ha6evgskw1m0fd80kkejmcpvk970ap8w731a076ghgxr5jkp7h80g1brsolanavk970ap8w731a076ghgxr5jkp7h80g1brwalletvk970ap8w731a076ghgxr5jkp7h80g1br

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments