Skillv1.0.0

ClawScan security

Etherscan · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 3, 2026, 4:13 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requests and runtime instructions are coherent with its stated purpose (querying Etherscan API); it only asks for an Etherscan API key (file or env) and makes HTTP GET calls — no unrelated credentials, installs, or surprising system access.
Guidance: This skill appears coherent and only needs an Etherscan API key. Before installing: (1) Prefer providing the key via an environment variable rather than letting the agent write a credentials file, or review/accept the exact file path (~/.config/etherscan/credentials.json) and its permissions if you want persistence. (2) Use a dedicated, limited Etherscan key (read-only) you can revoke if needed. (3) Be cautious about pasting secrets into chat — the SKILL.md says 'don't echo it', but copy/paste can leak into logs; if asked for the key interactively, supply it via the environment or the designated file instead. (4) Note the skill can run autonomously (normal default); because it only uses the Etherscan key and public HTTP calls, the blast radius is limited, but revoke the key if you see unexpected behavior. (5) If you require stricter guarantees, ask the publisher for more details or prefer transient keys rather than persistent files.

Purpose & Capability: okName/description match the instructions: all documented endpoints, chain list fetch, and API key usage are directly tied to querying Etherscan v2. No unrelated services or credentials are requested.
Instruction Scope: noteSKILL.md instructs the agent to read an API key from ~/.config/etherscan/credentials.json or $ETHERSCAN_API_KEY, to cache a chain list fetched from Etherscan, and to persist the API key to disk (example bash snippet). These actions are within scope for an API client, but they introduce persistent storage of a secret which the user should be aware of.
Install Mechanism: okNo install spec and no code files — instruction-only skill. That minimizes disk writes/install risk.
Credentials: okOnly an Etherscan API key is referenced (via env var or credentials file). The number and type of secrets requested are proportionate to the stated functionality; no unrelated environment variables or cloud credentials are requested.
Persistence & Privilege: noteSkill is not always-included and uses normal autonomous invocation defaults. It does instruct storing the API key to ~/.config/etherscan/credentials.json (with suggested chmod 600) — this is expected but the user should note the persistent secret on disk and where it is written.