logos-node

ReviewAudited by ClawScan on May 15, 2026.

Overview

The skill coherently helps manage a Logos testnet node, but it performs expected high-impact server administration such as downloading node binaries, enabling a service, opening a firewall port, reading the node wallet key, and wiping node state during breaking updates.

Install this only on a Linux x86_64 server you intend to operate as a Logos testnet node. Review commands before running them, verify the GitHub release assets you download, save or back up wallet/config information before breaking updates, and remember the systemd service and UDP port remain active until you stop or disable them.

Publisher note

Install, update, or check the status of a Logos Blockchain testnet validator node

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the optional installer trusts the current contents of that GitHub branch to change local agent skill files.

Why it was flagged

The optional installer pulls skill files from a moving GitHub branch before copying them into agent skill directories. It is user-directed and prompts per detected agent, but it is not pinned to a commit.

Skill content
TARBALL="https://github.com/${REPO}/archive/refs/heads/${BRANCH}.tar.gz" ... curl -fsSL "$TARBALL" | tar -xz -C "$TMP_DIR" --strip-components=1
Recommendation

Prefer the registry/ClawHub install path when possible, or inspect and pin the installer/repository revision before using the curl-to-bash option.

What this means

If the selected release asset is wrong or compromised, the host could run untrusted node software.

Why it was flagged

The skill downloads a release-provided node binary and configures systemd to execute it. This is central to installing a validator node, but users rely on the integrity of the upstream release assets.

Skill content
curl -L -o logos-blockchain-node.tar.gz "<BINARY_URL_FROM_RELEASE>"; tar -xf logos-blockchain-node.tar.gz; ... ExecStart=/pool0/logos/logos-blockchain-node /pool0/logos/user_config.yaml
Recommendation

Use official Logos release URLs, review the selected asset names, and verify checksums/signatures or release provenance when available before starting the service.

What this means

Running the update flow at the wrong time could erase local chain state and the node wallet configuration.

Why it was flagged

The breaking-update procedure intentionally removes existing Logos node state, config, and circuits. The paths are specific and the behavior is disclosed, but the operation is destructive.

Skill content
rm -rf /pool0/logos/state
rm -f  /pool0/logos/user_config.yaml
rm -rf /pool0/logos/.logos-blockchain-circuits
Recommendation

Run update only for intended breaking releases, confirm the paths, and back up or record any wallet/config information before deletion.

What this means

Wallet-related data from user_config.yaml could be exposed to anyone with access to the agent conversation or logs.

Why it was flagged

The status flow reads a wallet key from the local Logos config and uses it in a localhost balance query. This is purpose-aligned and bounded, but the key may appear in the agent transcript.

Skill content
grep -A3 known_keys /pool0/logos/user_config.yaml ... curl -s http://localhost:8080/wallet/<key>/balance
Recommendation

Treat wallet/config output as sensitive, redact private material before sharing logs, and use testnet-only wallets for this node.

What this means

The node can continue running, using network and disk resources, after the agent interaction is over.

Why it was flagged

The install creates a persistent service that restarts on failure and is enabled under systemd. This is expected for a validator node and is disclosed.

Skill content
Restart=on-failure ... systemctl enable logos-blockchain-node ... systemctl start logos-blockchain-node
Recommendation

Know how to monitor, stop, disable, or remove the systemd service if you no longer want the node running.