Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Indigo Assets

v1.0.0

Query real-time prices and data for Indigo Protocol iAssets, ADA, and INDY tokens.

0· 291·0 current·0 all-time
byAngelos Kappos@adacapo21

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for adacapo21/indigo-assets.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Indigo Assets" (adacapo21/indigo-assets) from ClawHub.
Skill page: https://clawhub.ai/adacapo21/indigo-assets
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install indigo-assets

ClawHub CLI

Package manager switcher

npx clawhub@latest install indigo-assets
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the declared MCP tools (get_assets, get_asset, get_asset_price, get_ada_price, get_indy_price). No unexpected binaries, env vars, or config paths are requested — the capability and declared requirements are consistent.
Instruction Scope
SKILL.md instructs the agent to use platform MCP tools to fetch prices and includes helpful references/sub-skills. It does not instruct reading user files or accessing unrelated system state. However, the skill metadata lists allowed-tools: Read, Glob, Grep (file read capabilities) which are not necessary for fetching price data and could be used to read local files if the agent is permitted — this is unexplained and worth caution.
Install Mechanism
No install spec and no code files — the skill is instruction-only, so nothing is downloaded or written to disk. This is the lowest install risk.
Credentials
No environment variables, credentials, or config paths are required. The skill does not request secrets or unrelated credentials.
Persistence & Privilege
always is false and the skill does not request persistent system-wide modifications or elevated privileges. Autonomous invocation (disable-model-invocation: false) is normal for skills and not by itself a red flag here.
What to consider before installing
This skill appears to do what it says (query Indigo iAssets, ADA, and INDY prices) and has no install or secret requirements, but proceed carefully because: (1) the author/source is unknown and there is no homepage to verify authenticity; (2) the skill metadata permits file-read tools (Read/Glob/Grep) which are unnecessary for price queries and could be used to access local files if the agent has that capability. Before installing, verify where the MCP tools (get_assets, get_asset, etc.) are implemented and who provides them; confirm that the skill will only call those trusted endpoints. If you lack that assurance, avoid enabling file-read permissions for the agent or run the skill in a restricted/sandboxed environment. If you need higher assurance, prefer skills published by verified sources or with a public homepage/repo.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dyqjvpz6t9vp8mvymwj6rf582mrn1
291downloads
0stars
1versions
Updated 10h ago
v1.0.0
MIT-0

iAsset Prices & Data

Query real-time prices and data for Indigo Protocol iAssets (iUSD, iBTC, iETH, iSOL), ADA, and INDY tokens.

MCP Tools

ToolDescription
get_assetsGet all Indigo iAssets with prices and interest data
get_assetGet details for a specific iAsset (iUSD, iBTC, iETH, iSOL)
get_asset_priceGet the current price for a specific iAsset
get_ada_priceGet the current ADA price in USD
get_indy_priceGet the current INDY token price in ADA and USD

Sub-Skills

References

Comments

Loading comments...