web3-data-skill

Explore Web3 on-chain data using Chainbase APIs. Use this skill when the user asks about blockchain data, token holders, wallet addresses, token prices, NFTs...

Security Scan

The skill's purpose (query Chainbase for on-chain data) matches its code, but the runtime instructions and script rely on undeclared environment variables and system binaries — a mismatch you should understand before installing.

Purpose & Capability

The name/description, README, SKILL.md, and scripts consistently target Chainbase APIs and on-chain queries — capability aligns with purpose. However, the skill requires using an API key (CHAINBASE_API_KEY) and shell tooling (curl, python3) which the registry metadata does not declare, reducing transparency.

Instruction Scope

SKILL.md instructs the agent to route user intents to Chainbase endpoints, optionally run SQL queries, and call the included wrapper script or curl. Instructions do not ask for unrelated system files, other credentials, or to transmit data to unknown endpoints — all network calls point to Chainbase domains. SQL fallback can perform large queries (up to 100k rows), which is expected but may be costly.

Install Mechanism

There is no install spec (instruction-only), and the shipped script is executed directly. That keeps install risk low, but running the provided script will invoke curl and python3 and write nothing persistent. The repo contains no external downloads. Still, executing bundled scripts is an action with risk and should be reviewed locally before running.

Credentials

The runtime uses CHAINBASE_API_KEY (falls back to 'demo') but the skill metadata declares no required environment variables or primary credential. Additionally, the script depends on curl and python3 but the registry lists no required binaries. The missing declarations reduce transparency about secret access and runtime requirements.

Persistence & Privilege

The skill does not request persistent/global privileges and does not set always:true. The script does not modify other skills or agent configs. Autonomous invocation is allowed (platform default) but not combined with other high-risk flags here.

What to consider before installing

This skill appears to do what it claims (query Chainbase) but has two practical transparency issues you should address before installing: (1) it reads CHAINBASE_API_KEY at runtime (defaulting to a public 'demo' key) even though the registry lists no required env vars — provide an API key only if you trust the skill and Chainbase, and expect rate limits with the demo key; (2) the included script requires curl and python3, but the metadata doesn't declare those binaries. Before installing, review scripts/chainbase.sh locally, confirm you have curl/python3 available, and decide whether to set CHAINBASE_API_KEY. If you want to be extra cautious, run the script in an isolated environment (container) and avoid supplying any sensitive keys you wouldn't give to a trusted integration.

Web3 Data Explorer (Chainbase)

Query on-chain data via Chainbase Web3 API and SQL API.

Quick Reference

API Key: Use env CHAINBASE_API_KEY, falls back to demo. If rate-limited, direct user to https://console.chainbase.com to upgrade.

Script: scripts/chainbase.sh <endpoint> [params...]

# Top token holders
scripts/chainbase.sh /v1/token/top-holders chain_id=1 contract_address=0xdAC17F958D2ee523a2206206994597C13D831ec7 limit=10

# Address labels
scripts/chainbase.sh /v1/address/labels chain_id=1 address=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045

# SQL query
scripts/chainbase.sh /query/execute --sql="SELECT * FROM ethereum.blocks ORDER BY number DESC LIMIT 5"

Chain IDs

Chain	ID	Chain	ID
Ethereum	1	Optimism	10
BSC	56	Base	8453
Polygon	137	zkSync	324
Avalanche	43114	Merlin	4200
Arbitrum	42161

Default to Ethereum (chain_id=1) unless user specifies otherwise.

Routing Logic

Match user intent to the right endpoint:

User wants	Endpoint
Top token holders / who holds a token	GET /v1/token/top-holders
List of holder addresses	GET /v1/token/holders
Token price	GET /v1/token/price
Historical token price	GET /v1/token/price/history
Token info (name, symbol, supply)	GET /v1/token/metadata
Token transfer history	GET /v1/token/transfers
Address labels/tags	GET /v1/address/labels
Wallet transaction history	GET /v1/account/txs
Single transaction detail	GET /v1/tx/detail
Native token balance (ETH/BNB)	GET /v1/account/balance
ERC20 token balances of wallet	GET /v1/account/tokens
NFTs owned by wallet	GET /v1/account/nfts
DeFi portfolio positions	GET /v1/account/portfolios
ENS domain lookup	GET /v1/ens/records or /v1/ens/reverse
NFT metadata/owner/rarity	GET /v1/nft/metadata, /owner, /rarity
Trending NFT collections	GET /v1/nft/collection/trending
Anything not covered above	SQL API (POST /query/execute)

Workflow

1. Identify intent — Determine what data the user needs
2. Resolve identifiers — If user gives token name (e.g. "USDT"), look up the contract address. Common tokens:
   • USDT: 0xdAC17F958D2ee523a2206206994597C13D831ec7 (ETH)
   • USDC: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 (ETH)
   • WETH: 0xC02aaA39b223FE8D0A0e5c4F27eAD9083C756Cc2 (ETH)
   • DAI: 0x6B175474E89094C44Da98b954EedeAC495271d0F (ETH)
   • WBTC: 0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599 (ETH)
   • If unknown, use GET /v1/token/metadata or ask the user for the contract address
3. Select endpoint — Use the routing table above; fall back to SQL API for complex/custom queries
4. Execute — Run via scripts/chainbase.sh or direct curl
5. Present results — Format data clearly with tables for lists, highlight key insights

SQL API Fallback

When fixed endpoints don't cover the query, translate user intent to SQL:

scripts/chainbase.sh /query/execute --sql="SELECT from_address, SUM(value) as total FROM ethereum.token_transfers WHERE contract_address = '0x...' GROUP BY from_address ORDER BY total DESC LIMIT 20"

Common table patterns (replace ethereum with chain name):

• {chain}.blocks — Block data
• {chain}.transactions — Transactions
• {chain}.token_transfers — ERC20 transfers
• {chain}.token_metas — Token metadata
• {chain}.logs — Event logs

SQL constraints: max 100,000 results per query.

For complete endpoint parameters and response schemas, read references/api-endpoints.md.