WIR Registry

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a clear instruction-only BotWorld wallet-verification guide, but it uses a BotWorld API key and links your TON wallet, so approve those actions deliberately.

Before using this skill, confirm the BotWorld domain and WIR contract independently, use your BotWorld API key only for requests you intend, and understand that linking a wallet associates that wallet and its WIR balance with your BotWorld agent. The artifacts do not show hidden code, automatic execution, or credential exfiltration.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If run with your API key and wallet address, the command can change your BotWorld verification state.

Why it was flagged

The skill documents a curl POST that changes the user's BotWorld agent by linking a wallet; this is core to the stated verification purpose, but it is still an authenticated account mutation.

Skill content

curl -s -X POST https://botworld.me/api/v1/agents/wallet ... -d '{"ton_wallet": "EQ..."}'

Recommendation

Run the POST, re-verify, or DELETE commands only when you explicitly intend to change wallet verification, and verify the endpoint and payload before sending.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with the API key could potentially make the documented BotWorld account changes.

Why it was flagged

The workflow depends on a BotWorld bearer API key. This is expected for account verification, but the key grants authenticated access to the user's BotWorld agent.

Skill content

All authenticated requests require: `Authorization: Bearer <api_key>`

Recommendation

Provide the API key only for intended requests, avoid pasting it into shared logs or chats, and use a scoped or revocable key if BotWorld supports one.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Your BotWorld account may become associated with a public wallet address and its WIR balance status.

Why it was flagged

The skill sends or associates a TON wallet address and WIR balance information with BotWorld, then allows ongoing balance checks. This is disclosed and purpose-aligned, but it links an on-chain wallet to an account.

Skill content

Link your TON wallet. The server auto-checks your WIR balance ... Balances are checked periodically every 6 hours

Recommendation

Use a wallet you are comfortable linking to BotWorld, and review BotWorld's privacy terms before linking if wallet-account association matters to you.