Warden Messari Agent

PendingStatic analysis audit pending.

Overview

No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may cause a USDC payment for each query if the user or agent signs the x402 payment payload.

Why it was flagged

The skill describes signing a payment authorization that can spend USDC for each request. This is purpose-aligned and disclosed, but it uses real wallet/payment authority.

Skill content
Payment: x402 USDC micropayments ($0.25 per request on Base mainnet) ... Create a signed EIP-3009 authorization (gasless; the facilitator submits the on-chain transfer)
Recommendation

Verify the amount, network, recipient, and payment header before signing; consider using a dedicated wallet or spending limits.

What this means

Questions sent through this skill may be visible to the external Messari/Warden service.

Why it was flagged

The skill routes user questions to an external A2A agent endpoint. This is the core purpose, but user-provided query text leaves the local environment.

Skill content
Base URL: `https://messari.agents.wardenprotocol.org` ... All queries use the A2A JSON-RPC 2.0 protocol on `POST /`.
Recommendation

Do not send secrets, private wallet information, or confidential business data in research prompts; verify the endpoint before use.

What this means

Users have less registry-provided information to confirm the publisher and official endpoint before making payments.

Why it was flagged

The registry metadata does not provide a source repository or homepage, which limits independent provenance checks for a skill that instructs users to interact with a paid external crypto service.

Skill content
Source: unknown; Homepage: none
Recommendation

Independently verify the Warden/Messari endpoint and any on-chain registration information before signing payments.