v1.0.1

Solana Stablecoin Payments in Real-time

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:17 AM.

Analysis

The skill appears to do what it claims—stream public Solana USDC/USDT transfer data from Bitquery—but users should protect the Bitquery API key and install the Python dependency carefully.

GuidanceThis skill is reasonable to install if you intend to stream Solana USDC/USDT transfers through Bitquery. Use a virtual environment, protect the BITQUERY_API_KEY, avoid logging the WebSocket URL, and run with `--timeout` if you do not want an indefinite stream.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

requirements.txt

gql[websockets]>=3.4.0

The skill relies on an external Python package with a lower-bound version rather than a pinned exact version. This is purpose-aligned for GraphQL WebSocket access, but dependency versions may change over time.

User impactInstalling the dependency may pull the latest compatible package versions from the Python ecosystem.

RecommendationInstall in a virtual environment or container, and pin reviewed dependency versions if using this in production.

Rogue Agents

SeverityInfoConfidenceHighStatusNote

scripts/stream_stablecoin_payments.py

print("Connected. Streaming Solana USDC/USDT transfers. Ctrl+C to stop.\n") ... else: await consume()

The default behavior is a continuous live stream until the user interrupts it; an optional timeout is also implemented. This is disclosed and central to the skill’s purpose, not hidden persistence.

User impactIf run without a timeout, the process can keep a WebSocket connection open and may consume terminal attention or Bitquery API quota until stopped.

RecommendationUse the documented `--timeout` option for bounded runs, or stop the stream with Ctrl+C when finished.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/stream_stablecoin_payments.py

key = os.getenv("BITQUERY_API_KEY") ... url = f"{BITQUERY_WS_BASE}?{urlencode({'token': api_key})}"

The skill uses a Bitquery API key from the environment and places it in the WebSocket URL for authentication. This is expected for the Bitquery integration and the code does not print the URL, but URL-carried tokens can be exposed by surrounding logs or tooling.

User impactYour Bitquery API token is needed to run the stream, and exposure of the full WebSocket URL could reveal that token.

RecommendationUse a dedicated Bitquery token with limited scope if available, avoid logging the full URL, run in a trusted environment, and rotate the token if it may have been exposed.