Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Easy Mining

v1.1.0

BTC mining farm management via natural language. Activate when user mentions mining farm, miners, hashrate, BTC mining, miner reboot, mining revenue, Nonce m...

0· 87·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for deanpeng-dotcom/easy-mining.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Easy Mining" (deanpeng-dotcom/easy-mining) from ClawHub.
Skill page: https://clawhub.ai/deanpeng-dotcom/easy-mining
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install easy-mining

ClawHub CLI

Package manager switcher

npx clawhub@latest install easy-mining
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name, description, and provided tools match a mining-farm management skill. The included CLI wrapper and mappings to Nonce MCP tools are coherent and proportionate for the stated functionality.
!
Instruction Scope
SKILL.md explicitly instructs the user to provide their Nonce API Key per request and to paste it into the conversation or pass it to the CLI. The packaged Python client sends the api_key as an argument to Antalpha's MCP server (https://mcp-skills.ai.antalpha.com/mcp). That means your API key is transmitted to Antalpha's server even though the docs claim keys are 'not stored' — transmission to a third party is concrete and present in the runtime instructions and code.
Install Mechanism
No install spec (instruction-only plus a small helper script) — low local install risk. However the included script communicates with a remote MCP server (Antalpha) over HTTPS; the install/packaging itself does not hide additional downloads or execution.
!
Credentials
The skill requests no environment variables or persistent credentials in metadata, but it requires you to supply a sensitive Nonce API key at runtime. Supplying that key is necessary to access Nonce data, but the key is forwarded to Antalpha's MCP endpoint rather than used directly by a local client — this additional transmission to a third party is not represented in required env/config fields and increases exposure.
Persistence & Privilege
The skill is not marked always:true and does not request system-level privileges or persistent local changes. The client opens short-lived MCP sessions to Antalpha's server; there is no code in the package that writes credentials to disk or modifies other skills.
What to consider before installing
Before installing or using this skill, understand that you will be asked to provide your Nonce API key and the included client will send that key to Antalpha's MCP server (https://mcp-skills.ai.antalpha.com/mcp) for every request. The SKILL.md asserts keys are 'not stored', but that claim cannot be verified from this package — the key will still be transmitted to a third party. Recommended precautions: (1) Prefer generating a scoped/restricted Nonce API key with minimal permissions and rotate it after testing; (2) Test with a non-production/test account first; (3) Avoid pasting long-lived production keys into chat — use the CLI with a short-lived/test key if possible; (4) Review Antalpha's privacy/security documentation or request an audit/attestation that keys are not logged/persisted; (5) If you need stronger guarantees, consider using a client that calls Nonce MCP directly (no intermediary) or run your own trusted proxy. If you want me to re-evaluate as benign, provide evidence or documentation that Antalpha's MCP server does not persist or log API keys (audit logs, retention policy, or a signed attestation).

Like a lobster shell, security has layers — review code before you run it.

latestvk97fbevacrq4hwra0ctvd9522d84nf07
87downloads
0stars
1versions
Updated 2w ago
v1.1.0
MIT-0

Easy Mining Skill 🦐

"一句话管理矿场" — 通过自然语言管理 BTC 矿场,无需打开 App,直接在对话中完成日常运维。

链路:OpenClaw → Antalpha MCP Server → Nonce MCP Server → 矿机


🚀 新手入门:绑定 Nonce API Key

在使用任何功能之前,你需要先绑定 Nonce API Key。以下是完整步骤:

第一步:注册 Nonce 账号

  1. 打开浏览器,访问 https://app.nonce.app
  2. 点击右上角 Sign Up 注册账号(支持邮箱注册)
  3. 完成邮箱验证后登录

第二步:生成 API Key

  1. 登录后,点击右上角头像,进入 Settings(设置)
  2. 找到 API Keys 选项卡
  3. 点击 Generate New Key
  4. 给 Key 取一个名字(如 my-ai-agent),点击确认
  5. 复制生成的 API Key(格式为 ak_XXXXXXXXXXXXXXXXXXXXXXXX

⚠️ API Key 只显示一次,请立刻保存好!如果丢失,需要重新生成。

第三步:验证连接

将 API Key 告诉我,我会帮你验证连接:

"我的 Nonce API Key 是 ak_XXXXXXXXXX,帮我验证一下连接"

验证成功后,你会看到你的 Workspace 信息和矿场列表。

第四步:开始使用

连接成功后,你可以直接用自然语言管理矿场:

  • 📊 "帮我看一下矿场概况"
  • ⚡ "现在有多少台矿机在线?算力多少?"
  • 🌡️ "有没有高温或异常的矿机?"
  • 💰 "过去7天的挖矿收益是多少?"
  • 🔄 "重启那台离线的矿机"(会先让你确认)

⚠️ 重要规则

Rule 1: API Key 每次传入,不落库

你的 API Key 仅在当次请求中使用,Antalpha MCP Server 不会存储你的 Key。每次对话时,如果需要调用矿场数据,我会使用你本次提供的 Key。

Rule 2: 写操作必须二次确认

easy-mining-create-task-batch写操作(重启/调频/升级等),调用前我会:

  1. 先列出将受影响的矿机列表
  2. 等你明确说"确认"后再执行
❌ 错误做法:直接执行重启
✅ 正确做法:
   1. 查询目标矿机列表
   2. 展示 → "将重启以下 3 台矿机:[列表],确认?"
   3. 用户回复"确认"后才调用 create-task-batch

Rule 3: 自动解析 Farm ID

大多数操作需要 farm_id,我会自动处理:

  • 只有一个矿场 → 自动使用
  • 多个矿场 → 询问你选哪个

📋 功能对照表

查询功能(只读)

你说的话调用的工具
验证 API Key 连接easy-mining-get-workspace
看我的矿场列表easy-mining-list-farms
矿机实时状态、算力、温度easy-mining-list-miners
过去 N 天收益easy-mining-list-metrics-history
某台矿机的历史算力/温度easy-mining-list-history
某台矿机的历史任务记录easy-mining-list-miner-tasks
矿池变更记录easy-mining-list-pool-diffs
查看历史任务批次easy-mining-list-task-batches
某个任务批次的进度easy-mining-get-task-batch

写操作(需二次确认)

任务类型task_name说明
重启矿机miner.system.reboot重启指定矿机
调整功耗模式miner.power_mode.update参数:{"mode": "low_power" | "normal" | "high_power"}
固件升级miner.firmware.update升级到最新固件
网络扫描miner.network.scan扫描矿机网络
矿池配置miner.pool.config参数:{"pool_url": "..."}
定位指示灯miner.light.flash让矿机 LED 闪烁以便定位

📊 返回格式示例

矿场概览

📊 矿场概览 — Kuching MY
├─ 总算力:48,500 GH/s(≈ 48.5 TH/s)
├─ 在线矿机:97 / 100 台
├─ 异常矿机:3 台(离线 2、高温 1)
└─ 今日收益:0.02112 BTC(≈ ¥1,450)

矿机列表(异常过滤)

⚠️ 异常矿机(3 台)
├─ [M001] 状态:offline | 最后在线:2h 前
├─ [M047] 状态:online  | 温度:78°C ⚠️ 过热
└─ [M089] 状态:offline | 最后在线:30min 前

收益历史

💰 7 天收益报表
┌─────────────┬──────────────┬──────────┐
│ 日期         │ BTC 收益     │ 在线矿机 │
├─────────────┼──────────────┼──────────┤
│ 2026-04-09  │ 0.02112 BTC  │ 100      │
│ 2026-04-08  │ 0.01991 BTC  │ 98       │
│ 2026-04-07  │ 0.02034 BTC  │ 100      │
└─────────────┴──────────────┴──────────┘
合计:0.14231 BTC(≈ ¥9,760)

🛠️ CLI 快速测试

# 验证 API Key
python3 scripts/mcp_client.py workspace --api-key <YOUR_KEY>

# 矿场列表
python3 scripts/mcp_client.py farms --api-key <YOUR_KEY>

# 矿机实时状态
python3 scripts/mcp_client.py miners --api-key <YOUR_KEY> --farm-id <FARM_ID>

# 收益历史(最近7天)
python3 scripts/mcp_client.py metrics \
  --api-key <YOUR_KEY> \
  --farm-id <FARM_ID> \
  --from-date 2026-04-03 --to-date 2026-04-09

# ⚠️ 重启矿机(写操作,需人工确认后执行)
python3 scripts/mcp_client.py create-task \
  --api-key <YOUR_KEY> \
  --farm-id <FARM_ID> \
  --task-name miner.system.reboot \
  --miner-ids <MINER_ID_1> <MINER_ID_2>

🔒 安全说明

安全项说明
API Key 不落库每次调用即用即弃,服务端不持久化
写操作二次确认所有 create-task-batch 必须展示影响范围并等待用户确认
只读优先默认只查询,用户明确要求时才执行写操作
Key 格式校验API Key 必须以 ak_ 开头,格式不符会立即报错

🆘 常见问题

现象原因解决方法
HTTP 401 UnauthorizedAPI Key 无效或已过期重新在 Nonce App → Settings → API Keys 生成
Cannot resolve workspace_idAPI Key 对应账号下无 Workspace检查是否用正确账号生成了 Key
HTTP 404farm_id / miner_id 不存在先调用 list-farms / list-miners 获取正确 ID
任务创建成功但矿机无响应矿机离线或网络中断检查矿机网络连接
收益显示为 0账号无真实收益数据(测试账号)确认是否为正式生产账号

📁 文件结构

easy-mining/
├── SKILL.md                    # 本文件(前端 Skill 定义)
├── README.md                   # 项目介绍(中英双语)
├── scripts/
│   └── mcp_client.py           # MCP 客户端封装(CLI 测试工具)
└── references/
    └── nonce-tools.md          # Nonce MCP 工具参考文档

Comments

Loading comments...