Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Crypto Wallet

Multi-chain cryptocurrency wallet management. Check balances, send tokens, view transaction history across Ethereum, Solana, Bitcoin and more.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 276 · 8 current installs · 8 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description promise (multi-chain wallet management and sending tokens) implies access to signing keys, wallet connectors, or custodial APIs, but the skill declares no env vars, no config paths, and contains no code or install steps to provide that access. That is disproportionate and internally inconsistent.
!
Instruction Scope
SKILL.md contains only high-level features, usage examples, and safety rules — no concrete runtime instructions for checking balances, querying RPC/explorer APIs, signing transactions, or broadcasting them. The instructions are vague and grant broad unspecified discretion to the agent.
Install Mechanism
Instruction-only skill with no install spec or code files. This is low-risk from an installation standpoint (nothing is written to disk or downloaded).
Credentials
No credentials or environment variables are requested. While good for limiting secret exposure, this is inconsistent with the stated ability to send tokens (which normally requires private keys, wallet connection, or a custodial API key). The absence of required creds raises questions about how transaction signing/broadcasting is intended to work.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-wide privileges. It is user-invocable and can be invoked autonomously by the agent (platform default), which is expected for skills.
What to consider before installing
This skill's description claims it can check balances and send tokens, but the provided instructions contain no technical details about how it would sign or broadcast transactions and request no credentials or wallet connectors. Before installing or using: (1) ask the author for explicit runtime details — how are transactions signed (local signing, hardware wallet, user-supplied signed TXs, or a custodial API)? (2) do not paste private keys or seed phrases into chat; never provide them to a skill. (3) request any required RPC endpoints, API keys, or integration docs and confirm whether the skill will ask the user to sign transactions manually. If you expect the skill to autonomously manage funds, prefer established wallet software or verified integrations; treating this skill as-is would be risky because its capabilities are underspecified and could lead to unsafe prompts or requests for secrets.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97eexz2b1q5cpejmehyjabywn82779f

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

💰 Clawdis
Binscurl, jq

SKILL.md

Crypto Wallet 💰

Manage cryptocurrency wallets across multiple blockchains.

Supported Chains

  • Ethereum (ETH, ERC-20)
  • Solana (SOL, SPL tokens)
  • Bitcoin (BTC)
  • Polygon (MATIC)
  • Arbitrum
  • Base

Features

  • Check wallet balances
  • View transaction history
  • Send tokens (with confirmation)
  • Token price lookup
  • Portfolio overview

Usage Examples

"What's my ETH balance?"
"Show my crypto portfolio"
"Send 0.1 ETH to 0x..."

Safety Rules

  1. ALWAYS confirm before sending transactions
  2. NEVER expose private keys
  3. ALWAYS verify recipient addresses

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…