OWS - Open Wallet Standard
v1.0.3Perform multi-chain wallet management, balance checks, transaction signing, x402 payments, funding, and policy control with encrypted local key storage using...
⭐ 0· 79·0 current·0 all-time
byRahul Sethuram@rhlsthrm
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the SKILL.md: it documents using a pre-installed 'ows' CLI and Node SDK for wallet listing, balance checks, signing, and x402 payments. Nothing requested (no env vars, no installs) is unrelated to a wallet CLI.
Instruction Scope
Instructions only show CLI commands that operate on local wallets (list, info, balance, sign, pay). This stays within the stated purpose, but the guidance is vague about how to unlock encrypted keys or handle passphrases and gives no guardrails for paying arbitrary URLs — both are operationally significant and can lead to accidental fund transfers if not explicitly constrained.
Install Mechanism
No install steps or downloads are provided; the skill is instruction-only and requires the user to pre-install the official OWS CLI. This minimizes install-time risk.
Credentials
The skill requests no environment variables or credentials, which is coherent. However, the skill instructs using a local CLI that will access encrypted private keys and perform signing/payments. The SKILL.md does not describe how passphrases or hardware wallet prompts are handled — the missing detail is relevant because those are sensitive secrets and operational decisions (e.g., whether the agent will ask the user to paste a passphrase).
Persistence & Privilege
Skill is not always-enabled, does not request system-wide config changes, and is instruction-only. Autonomous invocation is allowed by platform default but is not combined here with elevated privileges or hidden persistence.
Assessment
This skill appears to do what it says (it drives a local OWS CLI to list wallets, check balances, sign transactions, and make x402 payments). Before installing/using it: 1) Only use with a trusted, pre-installed OWS binary from the official sources listed in SKILL.md; verify the binary and its path. 2) Never paste raw private keys into the agent. Treat passphrases as sensitive — prefer to unlock wallets locally or via hardware wallets rather than pasting secrets into chat. 3) Be cautious with any 'pay' action: the CLI can send payments to arbitrary URLs (x402); require explicit human confirmation for any outbound payment and verify destination URLs. 4) Limit the agent's autonomy for this skill (do not allow unattended signing/payments) and monitor audit logs and wallet activity closely. If you need further assurance, ask the skill author for explicit instructions on passphrase handling, confirmation prompts, and domain allowlists for x402 payments.Like a lobster shell, security has layers — review code before you run it.
latestvk970br70dt6hw6k2b15b5c99b983jmwp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.