360 Secure SkillHub
360 安全技能中心

GoodWallet

通过全局安装的 goodwallet CLI 在多条链上查询余额与持仓,执行转账、兑换、永续合约交易、预测市场下注和 DeFi 存取,并完成 MPC 签名;需浏览器完成登录授权,涉及资金变动的操作执行前需用户确认。

peteremiljensen
peteremiljensen
热度 65.68
最近更新 2026-05-11 17:32:57
分类:生活依赖:代码执行 / 联网浏览搜索 / 第三方 API应用场景:个人理财

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add goodwallet
Metadata
name
goodwallet
description
Crypto wallet for sending, swapping, trading perps, betting on Polymarket, earning DeFi yield, and signing across EVM, Solana, Bitcoin, Doge, and XRP. Use when the user asks about wallets, balances, sending tokens, swaps, trades, bets, vaults, or signing.
metadata
{"openclaw":{"emoji":"👛","homepage":"https://goodwallet.etoro.com","npm":"https://www.npmjs.com/package/goodwallet","publisher":"GoodDollar","requires":{"bins":["node"]},"install":[{"id":"node","kind":"node","package":"goodwallet","bins":["goodwallet"],"label":"Install Goodwallet CLI (npm)"}],"auth":{"method":"browser-oauth","description":"Interactive browser login via `goodwallet auth`; no API key required"},"data":{"config_path":"~/.config/goodwallet/","contents":"Wallet configuration, encrypted MPC key shares (ECDSA + Ed25519), and auth tokens. No full private key is ever stored — only a single MPC share."},"external_services":[{"domain":"sign.goodwallet.etoro.com","purpose":"MPC co-signer relay — holds the second key share and performs 2-party signing. Operated by GoodDollar.","protocol":"HTTPS/WSS"},{"domain":"agent.goodwallet.etoro.com","purpose":"Agent API — issues signing room UUIDs and enforces transaction policy. Operated by GoodDollar.","protocol":"HTTPS"}]}}

Goodwallet

Crypto wallet CLI. Run goodwallet --help for the latest commands, flags, chains, and usage.

Setup

This skill assumes the goodwallet CLI is installed globally and available in PATH. If not, install it via npm. Do NOT use npx. Always use the globally installed binary.

Updates

After any goodwallet command, an "Update Available" or "Major Update Available" block may appear at the end of output. When it does you MUST surface it to the user, ask whether to upgrade, and run goodwallet update if they agree. Do not silently ignore it.

Rules

  • Summarize outcomes in plain language; don't dump raw CLI output unless asked.
  • Never fabricate values. Only report what the CLI returns.
  • Read before write: inspect balances/quotes/positions before proposing any state-changing action.
  • Confirm before executing any command that moves funds or creates exposure: send, swap --execute, trade --deposit/--withdraw/--market, bet --deposit/--withdraw/--market, earn --deposit/--withdraw, and every sign command.
  • Don't reveal internal wallet details unless the user asks.

Auth

  1. goodwallet auth — show the returned URL to the user.
  2. goodwallet auth --pair — run immediately; polls until the browser flow completes.
  3. goodwallet auth --logout — disconnect.

Signing Safety

All credentials and MPC key shares are stored locally at ~/.config/goodwallet/. No full private key ever exists — only a single MPC key share is stored on device. Signing uses 2-party MPC with a remote co-signer at sign.goodwallet.etoro.com (operated by GoodDollar). The agent API at agent.goodwallet.etoro.com issues signing room UUIDs and enforces transaction-policy checks (token allowlists, spend limits, malicious-contract detection) before co-signing, so most harmful payloads are rejected server-side. Both services communicate over HTTPS/WSS. Still, confirm with the user before running any sign command so they understand what they're approving.

Error Recovery

  • Auth timeout → restart auth + auth --pair.
  • Insufficient funds → suggest checking balances or reducing amount.
  • No swap route → suggest different token, amount, or chain.
  • Any other failure → report the error plainly, don't retry automatically.