Security audit
Security checks across malware telemetry and agentic risk
This skill is transparent about paid blockchain analytics, but it handles a crypto private key and can authorize real USDC payments with insufficient local safeguards.
Install only if you are comfortable funding and exposing a dedicated low-balance Base USDC wallet to this skill. Do not use a main wallet, avoid --yes and global auto-confirm in agent workflows, prefer environment variables or a secret manager over config.json, and remember that epstein-search sends your search terms to DugganUSA rather than the Einstein x402 service.
process.exit(1);
}
const limit = parseInt(args.limit || '10', 10);
const apiUrl = `https://analytics.dugganusa.com/api/v1/search?q=${encodeURIComponent(query)}&indexes=epstein_files`;
process.stderr.write(`Searching Epstein files for: "${query}" (limit: ${limit}) — FREE\n`);
try {| `--raw` | Data-only response (cheaper) | `false` | | `--yes` / `-y` | Skip payment confirmation prompt | `false` | To skip the confirmation prompt globally, set `EINSTEIN_AUTO_CONFIRM=true` or add `"autoConfirm": true` to config.json. ### `einstein-setup.mjs` (setup wizard)
| `--raw` | Data-only response (cheaper) | `false` | | `--yes` / `-y` | Skip payment confirmation prompt | `false` | To skip the confirmation prompt globally, set `EINSTEIN_AUTO_CONFIRM=true` or add `"autoConfirm": true` to config.json. ### `einstein-setup.mjs` (setup wizard)
**What gets signed.** Each paid query signs an EIP-3009 `TransferWithAuthorization` message that authorizes a USDC transfer of the exact query price (shown before confirmation) from your wallet to the Einstein service address. The signature is single-use (unique nonce) and time-limited. No blanket approvals are granted. **Payment confirmation.** By default, the CLI prompts before every paid query showing the exact cost. To skip the prompt for scripted/automated use, pass `--yes` / `-y` per-command or set `EINSTEIN_AUTO_CONFIRM=true` globally. **No auto-installed packages.** The setup wizard does NOT run `npm install` automatically. You must install dependencies yourself so you can audit what is being installed.
process.stderr.write(`Endpoint: ${url}${isRaw ? '/raw' : ''}\n`);
process.stderr.write(`Params: ${JSON.stringify(body)}\n`);
// Payment confirmation — skip with --yes, -y, EINSTEIN_AUTO_CONFIRM=true, or autoConfirm in config
const skipConfirm = args.yes === true || config.autoConfirm === true;
if (!skipConfirm) {
const confirmed = await confirmPayment(`\nThis will spend ~$${price} USDC. Proceed? (Y/n): `);process.stderr.write(`Endpoint: ${url}${isRaw ? '/raw' : ''}\n`);
process.stderr.write(`Params: ${JSON.stringify(body)}\n`);
// Payment confirmation — skip with --yes, -y, EINSTEIN_AUTO_CONFIRM=true, or autoConfirm in config
const skipConfirm = args.yes === true || config.autoConfirm === true;
if (!skipConfirm) {
const confirmed = await confirmPayment(`\nThis will spend ~$${price} USDC. Proceed? (Y/n): `);const envKey = process.env.EINSTEIN_X402_PRIVATE_KEY;
const envBaseUrl = process.env.EINSTEIN_BASE_URL;
const envChain = process.env.EINSTEIN_DEFAULT_CHAIN;
const envAutoConfirm = process.env.EINSTEIN_AUTO_CONFIRM === 'true';
// 2. Fall back to skill-local config.json for any missing values
let fileCfg = {};const envKey = process.env.EINSTEIN_X402_PRIVATE_KEY;
const envBaseUrl = process.env.EINSTEIN_BASE_URL;
const envChain = process.env.EINSTEIN_DEFAULT_CHAIN;
const envAutoConfirm = process.env.EINSTEIN_AUTO_CONFIRM === 'true';
// 2. Fall back to skill-local config.json for any missing values
let fileCfg = {};privateKey: envKey || fileCfg.privateKey,
baseUrl: envBaseUrl || fileCfg.baseUrl || 'https://emc2ai.io',
defaultChain: envChain || fileCfg.defaultChain || 'base',
autoConfirm: envAutoConfirm || fileCfg.autoConfirm || false,
};
}privateKey: envKey || fileCfg.privateKey,
baseUrl: envBaseUrl || fileCfg.baseUrl || 'https://emc2ai.io',
defaultChain: envChain || fileCfg.defaultChain || 'base',
autoConfirm: envAutoConfirm || fileCfg.autoConfirm || false,
};
}privateKey: envKey || fileCfg.privateKey,
baseUrl: envBaseUrl || fileCfg.baseUrl || 'https://emc2ai.io',
defaultChain: envChain || fileCfg.defaultChain || 'base',
autoConfirm: envAutoConfirm || fileCfg.autoConfirm || false,
};
}"private": true,
"description": "OpenClaw skill for Einstein x402 blockchain analytics services",
"dependencies": {
"viem": "^2.0.0"
}
}64/64 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal