Indigo Staking
PassAudited by VirusTotal on May 10, 2026.
Overview
Type: OpenClaw Skill Name: indigo-staking Version: 1.0.0 The indigo-staking skill bundle provides a comprehensive set of instructions and tool definitions for interacting with the Indigo Protocol's INDY staking mechanism on Cardano. The tools facilitate querying staking positions and generating unsigned transaction CBOR for opening, adjusting, or closing positions, which requires explicit user signing. No evidence of data exfiltration, malicious execution, or prompt injection was found; the content is consistently aligned with its stated purpose of DeFi portfolio management.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could be asked to sign a transaction that targets the wrong staking position or uses the wrong amount unit if they rely on the simplified examples without careful wallet review.
This reference shows financial transaction tools require precise owner, UTxO, and smallest-unit fields. The management guide simplifies the same workflows to calls like `adjust_staking_position({ address: "addr1q...", amount: 2000 })` and describes whole INDY amounts, creating ambiguity that could cause wrong transaction construction.
`adjust_staking_position` requires `address` as `User Cardano bech32 address`, `stakingTxHash`, `stakingOutputIndex`, and `amount` as `New staked INDY amount (smallest unit)`.
Resolve the tool schemas and units across all docs, and require a human-readable transaction preview covering action, address, UTxO, amount units, fee, and effects before any signing or submission.
The safety of real staking operations depends on whatever MCP server supplies these tools, which this package does not include.
The package is instruction-only and declares only file/search tools in frontmatter while relying on external MCP tools for staking operations. The actual MCP implementation and provider provenance are outside the reviewed artifacts.
allowed-tools: Read, Glob, Grep ... ## MCP Tools ... `open_staking_position` ... `adjust_staking_position` ... `close_staking_position`
Use only with a trusted Indigo MCP provider, verify the tool source and network, and inspect transaction details before signing.
A user may pay a fee to trigger an action that affects all stakers, not only their own position.
The reward distribution action can update many staking positions in one on-chain transaction. This is purpose-aligned, but it has broader protocol impact than a single-account query.
Anyone can call this tool — it is a permissionless on-chain action that processes pending rewards for all stakers.
Before signing, verify pending rewards, expected fee, number of affected positions, and that the transaction is on the intended Cardano network.