SPAWN Incubator

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only Web3 incubator skill is coherent and transparent about fees and revenue sharing, but users should verify contract details and approve any wallet transactions themselves.

Before using this skill, make sure you understand the non-refundable entry fee, the 20% revenue share, weekly heartbeat requirement, and Base L2 transaction risks. Do not share private keys, verify contract addresses independently, and approve wallet transactions only after reviewing them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used carelessly, the agent could help initiate a non-refundable blockchain payment.

Why it was flagged

This is a user-directed on-chain write that spends ETH. It is central to the incubator purpose and disclosed, but should not be performed automatically or without wallet confirmation.

Skill content
Call `applyToIncubator(string ideaURI, string ideaHash)` ... with the entry fee attached ... `msg.value`: At least the current entry fee
Recommendation

Verify the fee, network, and destination contract before signing, and require explicit user approval for any transaction.

What this means

A business using the router would route part of its on-chain revenue to the SPAWN treasury for the disclosed period.

Why it was flagged

Using the protocol affects wallet/business payment flows. This is disclosed and purpose-aligned, but it involves meaningful account and revenue authority.

Skill content
Customers pay this address, and it automatically splits: - **80%** to your wallet - **20%** to the SPAWN treasury
Recommendation

Use a wallet and payment setup you are comfortable committing to, and review the router terms before directing customers to it.

What this means

A user may rely on the website-provided contract addresses when sending funds or interacting with the protocol.

Why it was flagged

The contract addresses are not pinned in the skill artifact; users or agents would retrieve them from a live website response, so independent verification matters before financial transactions.

Skill content
Contract addresses are available via `GET /api/stats`.
Recommendation

Cross-check contract addresses through trusted sources and block explorers before signing transactions.