Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Base Alpha Scanner
v1.0.0Real-time Base chain alpha intelligence for ZHAO (CryptoZhaoX). Use when scanning Base memecoins for second-wave setups or early gem launches; checking GMGN...
⭐ 0· 369·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with the included scripts: both scan on-chain data (DexScreener, Basescan, GMGN) and narrative sources (Clanker, Bankr, Virtual). The external endpoints called are appropriate for on-chain/narrative scanning. Minor mismatch: SKILL.md shows invocation paths like `python3 skills/base-alpha-scanner/scripts/scan_base.py` while the packaged files are at `scripts/scan_base.py` — this path inconsistency could break runtime invocation or cause confusion.
Instruction Scope
SKILL.md instructs running the included Python scripts and using browser/web_fetch for sites that require sessions (GMGN, Warpcast). Those instructions stay within the described scanning purpose. However SKILL.md suggests both on-demand and 'continuous background' operation; the package contains only standalone scripts (no daemon/service) — continuous behavior would require external orchestration. SKILL.md also references using the agent's browser tool and screenshots for GMGN, which is manual/interactive rather than autonomous.
Install Mechanism
No install spec or remote downloads; the skill is instruction + included Python scripts only. That is low install risk (nothing is fetched or executed at install time).
Credentials
The code and references mention an optional BASESCAN_API_KEY and show an `apikey` placeholder in the Basescan URL; yet the skill declares no required env vars. Not declaring optional but used credentials is potentially confusing but not necessarily malicious. Aside from that, no unrelated secrets or unusual environment access are requested. The scripts make many outbound requests to public APIs (DexScreener, Basescan, GMGN, Clanker, Bankr, Virtual), which is consistent with the stated purpose.
Persistence & Privilege
Flags show normal defaults (always: false, agent can invoke autonomously). The skill does not request permanent/always-on inclusion or modify other skills. It merely provides scripts for on-demand scanning.
What to consider before installing
This package looks like a legitimate Base-chain scanner, but do not run it unreviewed. Specific points to consider before installing or executing:
- Fix the path mismatch: SKILL.md references `skills/base-alpha-scanner/scripts/...` while files live under `scripts/...`; adjust invocation or file placement to avoid runtime errors.
- The code references a Basescan API key (and includes a placeholder apikey param) but the skill does not declare required env vars; if you supply BASESCAN_API_KEY, treat it like any secret — store it securely and only provide least-privilege keys.
- There is at least one apparent bug in scripts/scan_base.py (a variable named `tota` is used instead of `total`), which will raise an exception; review and test the scripts in a sandboxed environment and fix obvious typos before trusting outputs.
- The scripts make outgoing HTTP requests to several third-party services (dexscreener, basescan, gmgn.ai, clanker.world, bankr.fun, api.virtuals.io). Ensure you are comfortable with network access and that any API keys you provide are appropriate for public API use. Expect that GMGN may require an interactive browser session and cookies — the skill suggests using a browser tool or screenshots for that data.
- If you plan to run continuous/background scans, implement external orchestration (cron, service) and monitoring; the package contains standalone scripts only.
- If you lack programming or ops expertise, ask for a code review from a trusted developer or run the scripts in an isolated VM/container first. The issues found look like sloppy engineering rather than deliberate misdirection, but sloppy code increases the risk of crashes and unexpected behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk9777cn6zv6t8rp8s347b7p1g98218qm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
