BagsWorld

PassAudited by ClawScan on May 10, 2026.

Overview

This is an instruction-only guide to the BagsWorld API with no local code, but it can create public/on-chain actions and involves wallet signing, so users should approve those steps carefully.

This skill appears coherent and instruction-only. Before using it, confirm you trust bagsworld.app, understand that joining or launching can make information publicly visible, and only sign Solana transactions after reviewing them in a trusted wallet.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

A user or agent could create a public token presence, configure fee recipients, or start a financial claim flow if these API calls are used.

Why it was flagged

The skill documents external API actions that can launch a token and initiate fee claiming. This is central to the stated purpose, but it affects public/on-chain economic state.

Skill content

"action": "launch" ... "Claim your fees" ... {"action": "claim", "wallet": "YOUR_WALLET"}

Recommendation

Require explicit user confirmation before launch, fee-splitting, leave, onboarding, or claim actions, and review all submitted token metadata and transaction details.

Note

ASI03: Identity and Privilege Abuse

What this means

If a user signs a malicious or misunderstood transaction, the blockchain action may be irreversible.

Why it was flagged

Claiming fees requires wallet-signing authority. The artifact does not show private keys being sent to BagsWorld, but wallet signing is high-impact.

Skill content

Returns unsigned Solana transactions. Sign with your private key and submit to RPC.

Recommendation

Sign only through a trusted wallet interface, inspect transaction contents before signing, and never paste or disclose a seed phrase or private key to the agent or website.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less provenance information to verify that the API and economic claims are legitimate.

Why it was flagged

The registry metadata does not provide source provenance or an official homepage, while the skill directs users to an external API for on-chain actions.

Skill content

Source: unknown; Homepage: none

Recommendation

Verify the bagsworld.app domain and community channels independently before sending wallet-linked data or signing any transaction.