Sweeps all native gas from a rotated-OUT SC wallet to the new wallet across every active EVM chain, via `script/tasks/moveNativeFundsToNewWallet.ts` — this is how every wallet rotation funds its replacement. Previews per-network balances first (read-only via `cast balance` — the script itself has no dry-run flag), derives the sender from the private key (never `config/global.json`), shows a human-confirmed pre-sweep report, and reports per-network moved/skipped/failed.
SkillScore86Maintained
Automatic
◆DevOps & SRE pack
Last verified 8/22/2026
What it changes
Passed 17 of 20 test cases with the skill, and 7 of 20 without it.
Without skill36%
With skill86%
Checks it passed that the model alone missed
Uses --newWalletAddress to pass the target address.
Directs the user to manage-wallet-funds in send mode.
Re-reads balances using cast balance after execution.
and 9 more in the full report
11 fixed8 passed either way3 still failing0 broke
Pass-rate lift
+50 pp
Tokens
+83%
Agent turns
0%
Response time
-56%
Model gemini-3.6-flashMeasured 8/22/2026v119 of 22 cases passed with skill · 20 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 11
Prompt
We are sweeping funds in a staging environment where --production is NOT passed. Which default environment variable should be passed to the task script?
What was checked, without and with the skill
Checked
Without skill
With skill
Specifies PRIVATE_KEY as the default key variable for staging runs.
Missed
Passed
case-11 · gemini-3.6-flash · 8/22/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md111 linessingle file
Sweep Wallet Funds (LI.FI Contracts)
Multi-chain native-gas sweep from a rotated-out SC wallet to its new replacement, run as the funding step of a wallet rotation. Wraps script/tasks/moveNativeFundsToNewWallet.ts, which iterates every active EVM chain and moves the native balance (minus a gas reserve) from the wallet the private key controls into the new address. This skill is the funding primitive that rotate-dev-wallet, rotate-deployer-wallet, and rotate-pauser-wallet call — it does not itself change any on-chain role or config; it only moves gas so the new wallet can operate.
When to use / when NOT
Use when:
"sweep the old <role> wallet to the new one" / "move the native funds across all chains to 0xNEW"
A rotate-* skill reaches its funding step (old wallet drained → new wallet bootstrapped).
"/sweep-wallet-funds --new-address 0xNEW"
Do NOT use when:
The user wants to fund a brand-new wallet from scratch (no old wallet to drain) → out of scope; use request-dev-funds (PR to the automate-wallet) or a single manage-wallet-funds send.
The user wants gas sent to an arbitrary recipient on a single chain → that is manage-wallet-funds in send mode (explicit-confirm-gated, one network/recipient).
The target role is refund / feeCollector / withdraw → CTO-owned, never rotated by SC tooling (see Guardrails). Stop and say so.
The only balance to move is Tron native → there is no multi-chain Tron script; handle as the documented manual step below, do not fake an EVM sweep of it.
Inputs
Required:
new wallet address (--new-address, EVM 0x…) — the rotation's replacement wallet; the sweep destination.
Optional:
old-key env var (--old-key-env, default PRIVATE_KEY_PRODUCTION in prod / PRIVATE_KEY staging) — which .env key controls the rotated-out wallet. Maps to the script's --privateKeyEnvKey.
--production — target production (default staging); mirrors the .env PRODUCTION=true double-opt-in rail. Selects the default --old-key-env (PRIVATE_KEY_PRODUCTION when set, PRIVATE_KEY otherwise).
--check — preview-only mode of this skill (NOT a script flag): run Phases 0–2 (balance preview via cast balance) and stop before any broadcast. moveNativeFundsToNewWallet.ts itself has no dry-run flag — never pass --check to it; citty silently ignores unknown flags and the script would broadcast a live sweep.
The old (source) wallet is never taken as input — it is derived from the key (see Guardrails). If --new-address is missing or not a valid EVM address, ask once and stop.
Guardrails
Custody guard. Only the SC-owned wallets may be swept as part of a rotation: deployer, dev, pauser. NEVER sweep or rotate refund / feeCollector / withdraw (CTO-owned). If the invoking context names one of those, stop and tell the user.
Derive the source, never look it up. The rotated-out (sender) address is derived from the private key via cast wallet address, inside a subshell, never echoed — and never read from config/global.json (the key and config can diverge mid-rotation; a wrong source makes a funded wallet look empty). Confirm the derived source matches the role's current on-chain address before sweeping.
Human-confirmed pre-sweep report. Use the same human-confirm rails as manage-wallet-funds send: render the per-network report and require explicit human confirmation before any broadcast. An agent must never self-approve. --check needs no confirmation (it moves nothing).
Secrets hygiene. Never print the private key or a full RPC URL; read keys in a subshell; redact URLs to host or env-var name in any output.
Native swept LAST. In a full rotation, native gas is the source wallet's ability to broadcast — so the sweep runs only AFTER all other moves that need the old key to sign (ownership transfers, proposal signatures) are done. Sweeping native first strands the old key with no gas to complete those txs. (moveNativeFundsToNewWallet.ts sweeps native last within itself; the ordering rule here is about where this skill sits in a rotation.)