Linkdrop Agent CLI

Create and redeem Linkdrop claim links from the command line with strict JSON output on Base, Polygon, Arbitrum, Optimism, and Avalanche.

Security Scan

This skill's code, instructions, and requested environment are consistent with a CLI that creates and redeems Linkdrop claim links; it will require your private key and Linkdrop API key and will perform RPC and API network calls, but there are no signs of unrelated or covert behavior in the bundle.

Purpose & Capability

The name/description match the code and instructions: the CLI creates/redeems Linkdrop links and sends on-chain transactions. Most requested env vars (PRIVATE_KEY, LINKDROP_API_KEY, per-chain RPC URLs, and Linkdrop endpoints) are appropriate for the declared purpose. Minor inconsistency: the registry metadata / SKILL.md mark many RPC and LINKDROP_* variables as required, but the code treats several of them as optional fallbacks (it uses defaults from viem chains or default Linkdrop URLs).

Instruction Scope

SKILL.md instructs the agent to run npm install and then node linkdrop-agent.js send|claim. The code only reads the declared environment variables and runs blockchain/RPC calls and Linkdrop API calls — all actions expected for the stated functionality. It does not attempt to read unrelated files or transmit data to unexpected endpoints (Linkdrop endpoints are configurable via env).

Install Mechanism

There is no explicit platform install spec in registry metadata (the skill is 'instruction-only' in that sense), but the bundle includes package.json and the SKILL.md instructs 'npm install'. Dependencies are fetched from npm (linkdrop-sdk@3.15.2-beta and viem@2.46.2). This is expected for a Node CLI, but installing npm packages pulls code from the public registry and the linkdrop-sdk is a beta release — you may want to audit dependencies or pin to a published stable release.

Credentials

The skill requests highly sensitive credentials (PRIVATE_KEY as primaryEnv) which is proportionate for a tool that signs and sends transactions. LINKDROP_API_KEY and per-chain RPC URLs are reasonable. Note: the metadata declares additional LINKDROP_* and RPC_* vars as required even though the code will accept defaults; treat declared 'required' vars carefully. Because the tool uses your raw private key to sign transactions, you should only run it with a key you control and trust for spending.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges or modify other skills. Running npm install will write node_modules into the working directory (normal for Node CLIs). The skill does not enable itself or modify agent configuration.

Assessment

This bundle appears to implement exactly what it claims: a strict-JSON CLI for creating and redeeming Linkdrop links. Before installing or running it, consider these practical precautions: - Do not supply your main wallet private key. Use a dedicated key with only the funds you are willing to spend or risk. - The CLI will sign and submit transactions using your PRIVATE_KEY and will call the Linkdrop API; those network targets are configurable via env (defaults are official Linkdrop endpoints). If you override LINKDROP_API_URL or RPC_URL_* with custom values, those endpoints will receive data. - The project requires npm install and pulls dependencies from the npm registry (linkdrop-sdk@3.15.2-beta is a pre-release). Audit package.json and consider running 'npm ci' with a lockfile or reviewing dependency versions before installing. - Verify the bundle against the upstream repository (https://github.com/seichris/linkdrop-sdk-cli) and confirm checksums or source provenance if you need high assurance. - Run the tool in an isolated environment (container or VM) if you are unsure, and test with small amounts on a testnet or with minimal funds first. Overall: coherent for its purpose, but handle the private key and dependency installation carefully.

When to use

• You need to create a funded Linkdrop claim link from a local wallet.
• You need to redeem a Linkdrop claim link to a destination address.
• You need stdout to be exactly one JSON object for automation.

Files in this skill

• linkdrop-agent.js is the strict JSON CLI entrypoint.
• agentdrop-core.js contains the Linkdrop and chain logic used by the CLI.
• .env.example shows the supported runtime configuration.

Setup

1. Run npm install.
2. Set secrets in your shell or .env:
   • Required: PRIVATE_KEY, LINKDROP_API_KEY
   • Recommended for Base: RPC_URL_BASE
   • Optional fallback: RPC_URL
3. Keep secrets out of git history.

Supported chains

• base default
• polygon
• arbitrum
• optimism
• avalanche

Send a claimable transfer

1. Native token on Base:
   • node linkdrop-agent.js send --amount 0.01 --token native --chain base
2. ERC20 on Polygon:
   • node linkdrop-agent.js send --amount 5 --token 0xTokenAddress --chain polygon
3. Read these JSON fields from stdout:
   • claimUrl
   • transferId
   • depositTx

Claim a transfer

1. Run:
   • node linkdrop-agent.js claim --url "https://..." --to 0xRecipient --chain base
2. Read redeemTx from stdout.

JSON contract

• Success returns { ok: true, ... }.
• Failure returns { ok: false, error: { code, name, message, details? } }.
• The CLI writes one JSON object to stdout per invocation.

Troubleshooting

• Missing PRIVATE_KEY: set a 32-byte hex private key with 0x prefix.
• Missing LINKDROP_API_KEY: set a valid Linkdrop API key with the zpka_ prefix.
• No RPC URL available: set RPC_URL_BASE for Base or the matching RPC_URL_<CHAIN>.
• Unsupported chain: use one of the supported chain names above.