Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Sharkflow

v0.2.0

⚡ SharkFlow - 链上任务自动化,智能合约交互队列 + 多签工作流

0· 338·1 current·1 all-time
byHaha Tan@gztanht

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for gztanht/sharkflow.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Sharkflow" (gztanht/sharkflow) from ClawHub.
Skill page: https://clawhub.ai/gztanht/sharkflow
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: npm, node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install gztanht/sharkflow

ClawHub CLI

Package manager switcher

npx clawhub@latest install sharkflow
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The README and SKILL.md describe a full DeFi automation tool (task queue, multisig, scheduled execution, transaction submission). The repository only contains a stub flow.mjs that prints a development message and a template.mjs that manages local JSON templates. There is a clear mismatch between claimed capabilities and the actual code provided.
!
Instruction Scope
SKILL.md instructs users to run commands like 'node scripts/flow.mjs add/execute/multisig' that imply performing on‑chain transactions and multi‑signature workflows. The actual flow.mjs file contains no implementation for those commands. The instructions also reference configuration files (config/wallets.json) and transaction behaviors that are not present in the code, which is misleading and could cause users to run commands expecting side effects that don't exist.
Install Mechanism
There is no install spec; this is instruction‑plus-source. No remote downloads or obscure install URLs are used. The package.json lists a single dependency (node-fetch) but no install scripts that pull arbitrary external code. Risk from install mechanism itself is low.
Credentials
The skill does not request environment variables, credentials, or config paths. The code writes and reads a local templates directory and references a config/wallets.json in its documentation, which is appropriate for a template/tooling package — but there is no code that reads private keys or external secrets.
Persistence & Privilege
The skill does not request persistent platform privileges (always: false) and does not modify other skills or system‑wide configurations. It does create/modify files under a local 'templates' directory within the project, which is expected for the template features.
What to consider before installing
This package promises full on‑chain automation (task queue, multisig, execution) but the actual code is a placeholder and a local template manager — it's internally inconsistent. Before running or installing: (1) don't paste private keys or seed phrases into any config files; use hardware wallets or external signing services if you intend to use on‑chain features; (2) inspect the actual scripts you will run (scripts/flow.mjs and scripts/template.mjs) — here flow.mjs is a harmless stub but the SKILL.md is misleading; (3) run the code in a sandboxed environment (container or VM) rather than your main machine; (4) verify the package source (the package.json points to a GitHub repo) and contact the author or check the repository history to confirm whether the promised features are implemented; (5) be cautious with 'npx' installs from unknown authors — they execute remote code. If you need real DeFi automation, prefer packages with implemented code, clear audit history, and minimal privilege requirements.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Clawdis
Binsnpm, node
latestvk97ch6djcf1kss8ry6qma5cddn82dh2q
338downloads
0stars
3versions
Updated 14h ago
v0.2.0
MIT-0

⚡ SharkFlow - 链上任务自动化

Automate Your On-Chain Workflow - 闪电般高效执行!

Overview

SharkFlow 是专为 DeFi 用户设计的任务管理工具,支持智能合约交互队列、多签工作流、定时任务执行等功能。批量操作、自动化执行,解放你的双手。

Features

  • 📋 任务队列 - 批量添加链上操作,一键执行
  • 🔐 多签支持 - 多签名钱包工作流管理
  • 定时任务 - 设定时间自动执行(如定投、复投)
  • 📊 历史追踪 - 完整的任务执行历史
  • 🔔 完成提醒 - Telegram/邮件通知
  • 🔄 模板系统 - 保存常用操作模板

Installation

npx @gztanht/sharkflow

Usage

创建任务

# 添加 USDT 存款任务
node scripts/flow.mjs add --action deposit --token USDT --amount 1000 --platform aave

# 添加 ETH 兑换任务
node scripts/flow.mjs add --action swap --from ETH --to USDC --amount 0.5

# 添加批量任务
node scripts/flow.mjs batch --file tasks.json

执行任务

# 执行队列中的任务
node scripts/flow.mjs execute

# 执行特定任务
node scripts/flow.mjs execute --id 123

# 模拟执行(不实际提交)
node scripts/flow.mjs execute --dry-run

多签工作流

# 创建多签任务
node scripts/flow.mjs multisig create --required 3 --signers 0x123,0x456,0x789

# 签名任务
node scripts/flow.mjs multisig sign --taskId 123

# 查看签名状态
node scripts/flow.mjs multisig status --taskId 123

定时任务

# 设置每周一定投
node scripts/flow.mjs schedule --action deposit --amount 100 --recur weekly --day monday

# 查看定时任务
node scripts/flow.mjs schedule --list

Supported Actions

操作描述支持平台
deposit存款Aave, Compound, Spark
withdraw取款Aave, Compound, Spark
swap代币兑换Uniswap, Curve, 1inch
stake质押Lido, Rocket Pool
claim领取奖励所有 yield 平台
bridge跨链Stargate, Hop, Across

Configuration

编辑 config/wallets.json 添加钱包:

{
  "wallets": [
    {"name": "Main", "address": "0x...", "type": "EOA"},
    {"name": "Safe", "address": "0x...", "type": "Safe", "required": 2, "signers": [...]}
  ]
}

Safety

  • ✅ 模拟执行 - 实际提交前预览结果
  • ✅ 限额设置 - 单笔/每日交易限额
  • ✅ 白名单 - 只允许预定义的合约交互
  • ✅ 多签确认 - 大额交易需要多签

Support

  • 📧 Email: support@SharkFlow.shark
  • 💬 Telegram: @SharkFlowBot
  • 🦈 赞助:USDT (ERC20): 0x33f943e71c7b7c4e88802a68e62cca91dab65ad9

License

MIT © 2026 gztanht

Comments

Loading comments...