Structs Mining

ReviewAudited by ClawScan on May 14, 2026.

Overview

The skill is coherent for Structs mining, but it uses a local signing key to launch long-running transactions that can auto-submit later, so users should approve and monitor each job carefully.

Install only if you intend the agent to help run Structs mining/refining transactions. Before approving any launch, verify the struct ID, planet ore, owner key, and whether you are comfortable with a completion transaction being auto-submitted many hours later. Monitor or kill background jobs if game state changes.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the wrong key, struct ID, or timing is approved, the agent could broadcast an unintended game/on-chain transaction.

Why it was flagged

The skill instructs use of a transaction CLI with the -y flag that suppresses confirmation prompts. This is disclosed and tied to the mining purpose, but it is still a high-impact action requiring explicit user approval.

Skill content
structsd tx structs struct-ore-mine-compute -D 3 --from [key-name] --gas auto --gas-adjustment 1.5 -y -- [struct-id]
Recommendation

Confirm the struct ID, account key, gas settings, and current game state before allowing any command that includes -y.

What this means

A misconfigured or overly privileged key could let the agent sign transactions from the wrong account.

Why it was flagged

The skill depends on a local signing key for Structs transactions. That credential use is expected for the purpose, but it gives the agent delegated authority over the selected account.

Skill content
**Requires**: [`structsd`](https://structs.ai/skills/structsd-install/SKILL) on PATH and a configured signing key.
Recommendation

Use a dedicated, least-privilege Structs key when possible and verify that --from names the intended owner before approval.

What this means

A job may still be active hours later and may submit a transaction after game conditions or user intent have changed.

Why it was flagged

The skill intentionally launches multi-hour background jobs that may keep running after the immediate chat session and later submit completion transactions automatically. The behavior is clearly disclosed and includes PID tracking guidance.

Skill content
Mining and refining are **expeditions** — long-running background jobs that auto-submit completion transactions when their proof lands.
Recommendation

Track each launched PID, re-check state before relying on a previous approval, and kill the process if the transaction is no longer desired.

What this means

The agent may rely on a remembered job state that is stale, failed, or no longer relevant.

Why it was flagged

The skill uses persistent job memory to reconnect to long-running operations. This is purpose-aligned, but stale or incorrect job records could affect later decisions.

Skill content
Log the PID to `memory/jobs/`; recall with `kill <pid>` if the situation changes.
Recommendation

Verify the actual process and game state before acting on any remembered job entry.

What this means

Users may not realize before installation that the skill depends on an external CLI and local key setup.

Why it was flagged

Registry requirements do not declare a required binary, while SKILL.md says structsd must be on PATH. This is an under-declared dependency rather than hidden code execution.

Skill content
Required binaries (all must exist): none
Recommendation

Ensure structsd is installed from a trusted source and configured intentionally before using this skill.