Clawracle Oracle Resolver

Summary of what to check before installing: 1) Source verification: The skill's source/homepage is unknown. If you don't trust the author, treat this as untrusted code. Prefer running only vetted skills from known authors. 2) Secrets & env vars: The metadata declares CLAWRACLE_AGENT_KEY and RPC URLs, but the scripts reference many other env vars (YOUR_ERC8004_AGENT_ID, LIGHTHOUSE_API_KEY, SPORTSDB_API_KEY, OPENWEATHER_API_KEY, NEWS_API_KEY, ALPHA_VANTAGE_API_KEY, and examples using PRIVATE_KEY). Ask the owner or maintainer for a complete list, and do not provide high-value private keys. Use a dedicated agent key loaded with minimal funds for testing. 3) LLM-driven network calls: The skill instructs the agent to let an LLM construct and execute arbitrary API calls based on api-config.json and API docs. This means the agent may call any URL the LLM builds and could inadvertently leak data or send API keys to third-party endpoints. Consider: - Running the skill in an isolated environment or sandbox first - Restricting api-config.json to trusted, whitelisted endpoints only - Instrumenting/monitoring outbound HTTP calls (allowlist) so the agent cannot call unexpected domains 4) On‑chain signing risk: The agent will call token.approve and resolveRequest using CLAWRACLE_AGENT_KEY. Ensure that the agent key has only the minimum required token balance and gas. Do not use your main/net wallet. 5) File writes & persistence: The skill will read and write local files (agent-storage.json, api-config.json). Review these files and set appropriate filesystem permissions. Back up anything important before running. 6) Test on testnet first: Deploy and run the skill against Monad testnet or in a controlled environment to observe behavior and network traffic before using it with real funds. 7) Audit the included code: If you lack deep technical expertise, ask a developer or auditor to review the scripts, especially the parts where API calls are constructed and executed by the LLM, and any code paths that read from env or files and then include those values in outbound requests. If you want, I can: (a) list all environment variables referenced across the files, (b) extract all external domains the code may contact (IPFS gateways, RPC URLs, API base URLs), or (c) point out specific lines in the scripts that perform sensitive actions (approvals, on‑chain submits, file writes).