ClawHub

Linkdrop Agent CLI

v1.0.0

Create and redeem Linkdrop claim links from the command line with strict JSON output on Base, Polygon, Arbitrum, Optimism, and Avalanche.

⭐ 0· 93·0 current·0 all-time
by@seichris
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The name/description match the code and instructions: the CLI creates/redeems Linkdrop links and sends on-chain transactions. Most requested env vars (PRIVATE_KEY, LINKDROP_API_KEY, per-chain RPC URLs, and Linkdrop endpoints) are appropriate for the declared purpose. Minor inconsistency: the registry metadata / SKILL.md mark many RPC and LINKDROP_* variables as required, but the code treats several of them as optional fallbacks (it uses defaults from viem chains or default Linkdrop URLs).
✓
Instruction Scope
SKILL.md instructs the agent to run npm install and then node linkdrop-agent.js send|claim. The code only reads the declared environment variables and runs blockchain/RPC calls and Linkdrop API calls — all actions expected for the stated functionality. It does not attempt to read unrelated files or transmit data to unexpected endpoints (Linkdrop endpoints are configurable via env).
ℹ
Install Mechanism
There is no explicit platform install spec in registry metadata (the skill is 'instruction-only' in that sense), but the bundle includes package.json and the SKILL.md instructs 'npm install'. Dependencies are fetched from npm (linkdrop-sdk@3.15.2-beta and viem@2.46.2). This is expected for a Node CLI, but installing npm packages pulls code from the public registry and the linkdrop-sdk is a beta release — you may want to audit dependencies or pin to a published stable release.
ℹ
Credentials
The skill requests highly sensitive credentials (PRIVATE_KEY as primaryEnv) which is proportionate for a tool that signs and sends transactions. LINKDROP_API_KEY and per-chain RPC URLs are reasonable. Note: the metadata declares additional LINKDROP_* and RPC_* vars as required even though the code will accept defaults; treat declared 'required' vars carefully. Because the tool uses your raw private key to sign transactions, you should only run it with a key you control and trust for spending.
✓
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges or modify other skills. Running npm install will write node_modules into the working directory (normal for Node CLIs). The skill does not enable itself or modify agent configuration.
Assessment
This bundle appears to implement exactly what it claims: a strict-JSON CLI for creating and redeeming Linkdrop links. Before installing or running it, consider these practical precautions: - Do not supply your main wallet private key. Use a dedicated key with only the funds you are willing to spend or risk. - The CLI will sign and submit transactions using your PRIVATE_KEY and will call the Linkdrop API; those network targets are configurable via env (defaults are official Linkdrop endpoints). If you override LINKDROP_API_URL or RPC_URL_* with custom values, those endpoints will receive data. - The project requires npm install and pulls dependencies from the npm registry (linkdrop-sdk@3.15.2-beta is a pre-release). Audit package.json and consider running 'npm ci' with a lockfile or reviewing dependency versions before installing. - Verify the bundle against the upstream repository (https://github.com/seichris/linkdrop-sdk-cli) and confirm checksums or source provenance if you need high assurance. - Run the tool in an isolated environment (container or VM) if you are unsure, and test with small amounts on a testnet or with minimal funds first. Overall: coherent for its purpose, but handle the private key and dependency installation carefully.

Like a lobster shell, security has layers — review code before you run it.

latestvk972tkcn6c932k51c99dq3eez183nhph

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsnode, npm
EnvPRIVATE_KEY, LINKDROP_API_KEY, RPC_URL, RPC_URL_POLYGON, RPC_URL_BASE, RPC_URL_ARBITRUM, RPC_URL_OPTIMISM, RPC_URL_AVALANCHE, LINKDROP_BASE_URL, LINKDROP_API_URL
Primary envPRIVATE_KEY

Comments