openmath-claim-reward
v1.0.4Claims earned rewards from the OpenMath platform. Use when the user wants to query claimable imported/proof rewards or withdraw verified Shentu rewards after...
⭐ 0· 134·1 current·1 all-time
byshentu-org@bennyzhe
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (claiming OpenMath rewards) align with included files and instructions: scripts query rewards and read an openmath-env.json. The SKILL.md requires python3 and shentud which are appropriate. Minor inconsistency: the registry metadata lists no required env vars while SKILL.md documents optional environment overrides (OPENMATH_ENV_CONFIG, SHENTU_CHAIN_ID, SHENTU_NODE_URL); this is a small documentation mismatch but not a functional red flag.
Instruction Scope
Runtime instructions are narrowly scoped: they read a project/user config (openmath-env.json), call the local shentud CLI to query rewards or tx status, and instruct the user to run shentud tx for withdrawals. The instructions explicitly require user confirmation before broadcasting and limit file access to the named config locations. No instructions ask to read unrelated system files or exfiltrate data.
Install Mechanism
No install spec (instruction-only with small helper scripts). No downloads or extracted archives. This minimizes risk; the only actions are running the included Python scripts and invoking the local shentud binary.
Credentials
The skill documents optional env vars for configuration (OPENMATH_ENV_CONFIG, SHENTU_CHAIN_ID, SHENTU_NODE_URL) which are appropriate for a blockchain RPC tool. It does not require unrelated credentials or secrets. Note: registry metadata reported 'Required env vars: none' while SKILL.md lists these as optional — the difference is informational only.
Persistence & Privilege
always:false and no special persistence or system-wide configuration changes are requested. The skill will invoke local binaries (normal for this task) but does not attempt to modify other skills or agent-wide settings.
Assessment
This skill appears to do exactly what it says: query claimable rewards and help with withdrawing them via your local shentud CLI. Before using it: 1) verify you have a trusted shentud binary on PATH (don’t run with an untrusted or downloaded binary), 2) check the openmath-env.json config paths it will read (~/.openmath-skills or ./.openmath-skills or the file pointed to by OPENMATH_ENV_CONFIG) to ensure it contains the expected prover_address, 3) confirm the exact key name/address with shentud keys show before broadcasting any tx (the skill explicitly requires user confirmation), and 4) verify the RPC node URL (default https://rpc.shentu.org:443 or your SHENTU_NODE_URL) — avoid pointing to unknown third‑party nodes when signing transactions. The included scripts are small and readable; if you plan to use the withdraw flow, follow the checklist in SKILL.md and do not broadcast transactions until you are certain the local key controls the reward address.Like a lobster shell, security has layers — review code before you run it.
latestvk977ye2dcyb6ckgv0ervh6dasd83kesj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.