obolnetwork/ethereum-local-wallet
internal/embed/skills/ethereum-local-wallet/SKILL.md
Execute Ethereum transactions NOW — send ETH, approve tokens, call contracts, sign messages. Uses the in-cluster remote-signer (agents never touch private keys). Use this skill whenever the user wants to DO something onchain, not just learn about wallets.
$ install --global
skillsauthnpx skillsauth add obolnetwork/obol-stack ethereum-local-walletInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 5, 2026, 7:34 AM119.0s3 files scanned
SKILL.md
- name:
- ethereum-local-wallet
- description:
- Execute Ethereum transactions NOW — send ETH, approve tokens, call contracts, sign messages. Uses the in-cluster remote-signer (agents never touch private keys). Use this skill whenever the user wants to DO something onchain, not just learn about wallets.
- metadata:
- { "openclaw": { "emoji": "💳", "requires": { "bins": ["python3"] } } }
Ethereum Wallet
Sign and send Ethereum transactions through the local remote-signer service. The agent never accesses private keys directly — all signing is done via HTTP API calls to the remote-signer, which holds encrypted keystores.
When to Use
- Sending ETH or ERC-20 tokens
- Signing messages (EIP-191) or typed data (EIP-712)
- Interacting with smart contracts that modify state (write operations)
- Approving token allowances
- Any operation that requires a transaction signature
When NOT to Use
- Read-only queries — use the
ethereum-networksskill instead (rpc.sh) - Key generation — keys are managed by the
obolCLI, not by the agent - Cross-chain bridges — not supported in this skill
Quick Start
# List your signing addresses
python3 scripts/signer.py accounts
# Check remote-signer health
python3 scripts/signer.py health
# Sign a message
python3 scripts/signer.py sign-msg 0xYOUR_ADDRESS "Hello, Ethereum!"
# Sign a transaction (returns raw signed tx hex, does NOT broadcast)
python3 scripts/signer.py sign-tx \
--from 0xYOUR_ADDRESS --to 0xRECIPIENT \
--value 1000000000000000000 --network mainnet
# Sign AND broadcast a transaction via eRPC
python3 scripts/signer.py send-tx \
--from 0xYOUR_ADDRESS --to 0xRECIPIENT \
--value 1000000000000000000 --network mainnet
Available Commands
| Command | Description |
|---------|-------------|
| accounts | List all signing addresses from the remote-signer |
| health | Check remote-signer /healthz endpoint |
| sign <address> <hex-data> | Sign a raw 32-byte hash |
| sign-msg <address> <message> | Sign a message with EIP-191 prefix |
| sign-tx --from --to [--value] [--data] [--gas] [--nonce] [--network] | Sign an EIP-1559 transaction |
| send-tx --from --to [--value] [--data] [--network] | Sign AND broadcast a transaction via eRPC |
| sign-typed <address> <json> | Sign EIP-712 typed data |
| gas-info [--network] | Print recommended base/tip/max fees from eth_feeHistory |
Transaction Submission Flow
1. Agent decides to send a transaction
2. signer.py: GET /api/v1/keys → list available signing addresses
3. signer.py: eth_getTransactionCount → eRPC (nonce)
4. signer.py: eth_gasPrice + eth_maxPriorityFeePerGas → eRPC (fees)
5. signer.py: eth_estimateGas → eRPC (gas limit)
6. signer.py: POST /api/v1/sign/{address}/transaction → remote-signer
→ Returns RLP-encoded signed transaction hex
7. signer.py: eth_sendRawTransaction → eRPC (broadcast)
8. signer.py: eth_getTransactionReceipt → eRPC (confirmation)
Multi-Network Support
The same signing key works on any EVM chain. Specify the network via --network:
python3 scripts/signer.py send-tx --network hoodi \
--from 0x... --to 0x... --value 1000000000000000000
Supported networks: mainnet, base, base-sepolia, hoodi, sepolia (depends on eRPC configuration). The aliases ethereum and eip155:<id> resolve to the canonical name. Unknown values fail with an explicit error rather than silently signing against chain id 1.
Gas & Tip Selection
sign-tx and send-tx auto-fill maxPriorityFeePerGas and maxFeePerGas using eth_feeHistory(20, latest, [50]) — the median 50th-percentile tip across the last 20 blocks, plus a base-fee headroom of 2*baseFee. Per-chain bounds clip the tip so quiet mainnet stays at ~0.05 gwei (instead of overpaying 1 gwei) and L2 stays sub-gwei.
To inspect what the oracle would choose without signing:
python3 scripts/signer.py gas-info --network mainnet
python3 scripts/signer.py gas-info --network base
If eth_feeHistory is unavailable, the oracle falls back to per-chain safe defaults rather than failing the transaction outright. Override with --max-fee and --max-priority only when you have a specific reason (e.g. cancelling a stuck tx).
Environment Variables
| Variable | Default | Description |
|----------|---------|-------------|
| REMOTE_SIGNER_URL | http://remote-signer:9000 | Remote-signer REST API base URL |
| ERPC_URL | http://erpc.erpc.svc.cluster.local/rpc | eRPC gateway for RPC calls |
| ERPC_NETWORK | mainnet | Default network for RPC routing |
Security Model
- Agent never touches keys: All signing via HTTP to the remote-signer
- ClusterIP isolation: Remote-signer is only reachable within the cluster
- Encrypted keystores: V3 Web3 Secret Storage format with scrypt KDF
- Values in wei: No automatic unit conversion — always specify amounts in wei
Important Notes
- Always confirm with the user before sending transactions
- Values are in wei (1 ETH = 1000000000000000000 wei)
- Use
ethereum-networksskill (rpc.sh balance <address>) to check balances before sending - The
send-txcommand will broadcast the transaction immediately after signing
See Also
ethereum-networks— read-only blockchain queries via eRPCreferences/remote-signer-api.md— full remote-signer REST API reference
Related Skills
obolnetwork/agent-factory
data-ai
VerifiedTrustedCommunity
Spawn durable child Hermes agents from inside Obol Stack. Creates child namespaces, optional profile/env Secrets, Agent CRDs, and optional ServiceOffers for x402-paid child services.
9SKILL.mdUpdated May 22, 2026
obolnetwork/buy-x402
data-ai
VerifiedTrustedCommunity
Buy from any x402-gated endpoint. Two flows: `pay` for one-shot HTTP services (single authorization, no sidecar), and `buy` for long-running paid inference (pre-authorized batch via PurchaseRequest, exposed as `paid/<remote-model>`). Supports USDC (EIP-3009) and OBOL (Permit2). Zero signer access at runtime — spending is capped by design and nothing moves on-chain until a voucher is spent.
9SKILL.mdUpdated May 2, 2026
obolnetwork/sell
testing
VerifiedTrustedCommunity
Sell access to services via x402 payment gating. Create ServiceOffer CRDs that automatically health-check upstreams, create payment-gated routes, and optionally pull models and register on ERC-8004. Supports inference, HTTP, and fine-tuning service types.
9SKILL.mdUpdated Apr 20, 2026
obolnetwork/monetize-guide
testing
VerifiedTrustedCommunity
End-to-end guide for monetizing GPU resources or HTTP services through obol-stack. Covers pre-flight checks, model detection, pricing research, selling via x402, ERC-8004 registration, and verification. Use this skill when the user wants to monetize their machine.
9SKILL.mdUpdated Apr 20, 2026