Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Etherlink Skill

v1.0.0

Etherlink blockchain interaction - EVM-compatible L2 on Tezos. Supports mainnet and shadownet testnet via MCP server. Use for balance checks, transactions, smart contracts, and token operations on Etherlink.

4· 1.6k·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for efekucuk/etherlink-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Etherlink Skill" (efekucuk/etherlink-skill) from ClawHub.
Skill page: https://clawhub.ai/efekucuk/etherlink-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install efekucuk/etherlink-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install etherlink-skill
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (Etherlink blockchain interaction) matches the included docs, network references, and test script. The skill's instructions focus on configuring an MCP server and using Etherlink RPCs which is coherent for the stated purpose. Minor concerns: the repository source is unknown and the references point to an unverified 'yourusername/etherlink-mcp-server' GitHub path and external domains (node.*.etherlink.com), so provenance is unclear.
Instruction Scope
SKILL.md stays mostly within expected scope (balance, txs, contracts, network selection). It explicitly instructs adding a PRIVATE_KEY/EVM_PRIVATE_KEY environment variable to the MCP configuration for write operations — which is expected for a wallet-like integration but is sensitive. The docs also instruct running remote packages (npx) or local builds; the guidance does not tell the agent to read unrelated system files or exfiltrate data, but it could cause the agent or user to place secret keys into a process environment that will run third-party code.
!
Install Mechanism
The skill itself has no install spec, but the included MCP setup docs recommend using 'npx -y etherlink-mcp-server' or cloning/running code (bun run). Using npx (or running an unverified GitHub-sourced server) executes code from external registries/hosts and can run arbitrary code. Because the upstream package/source is unverified here and no official homepage/repository is provided, this is a notable risk.
Credentials
The skill does not declare required env vars in metadata, which is correct for an instruction-only skill. However SKILL.md and mcp-setup.md explicitly recommend setting PRIVATE_KEY / EVM_PRIVATE_KEY in MCP server env for write operations. Requesting a signing key is proportionate to sending transactions, but storing private keys in MCP config or passing them to npx-run servers is sensitive and should be minimized (use read-only mode, hardware wallets, or ephemeral keys for testing).
Persistence & Privilege
No always:true flag, no installs that modify other skills or system-wide settings. The skill is instruction-only plus a small test script and reference docs; it does not request elevated platform privileges in its metadata.
What to consider before installing
This skill appears to be what it says — documentation and a small test script for interacting with an Etherlink RPC — but exercise caution before you run or install any related MCP server code. Specific actions to take before installing/using: - Verify origin: ask the publisher for a canonical homepage or repository. Do not run npx or clone/run code from an untrusted/unknown package. - Audit server code: if you plan to run an MCP server, fetch its source (git) and review it locally before running. Avoid 'npx -y' for untrusted packages. - Protect private keys: never place a high-value private key into a third-party MCP config you haven't audited. Use read-only mode for routine queries; use an ephemeral or testnet key for experiments. - Prefer running your own RPC or MCP instance behind your control to avoid sending sensitive signing material to remote code. - Test on Shadownet first and confirm RPC endpoints (node.*.etherlink.com) are legitimate and reachable. If you cannot verify the upstream package/repository or inspect the MCP server source, treat the recommended install commands (npx, remote builds) as a significant risk and avoid providing real private keys.

Like a lobster shell, security has layers — review code before you run it.

blockchainvk979qaqpgab4g3s6xt115n68rs80dwk8cryptovk979qaqpgab4g3s6xt115n68rs80dwk8etherlinkvk979qaqpgab4g3s6xt115n68rs80dwk8evmvk979qaqpgab4g3s6xt115n68rs80dwk8latestvk979qaqpgab4g3s6xt115n68rs80dwk8tezosvk979qaqpgab4g3s6xt115n68rs80dwk8web3vk979qaqpgab4g3s6xt115n68rs80dwk8
1.6kdownloads
4stars
1versions
Updated 6h ago
v1.0.0
MIT-0

Etherlink Skill

Interact with Etherlink, an EVM-compatible L2 built on Tezos.

Quick Start

1. Configure MCP Server

Add to your Claude/MCP config:

{
  "mcpServers": {
    "etherlink": {
      "command": "bun",
      "args": ["run", "/path/to/etherlink-mcp-server/src/index.ts"],
      "env": {
        "EVM_PRIVATE_KEY": "your-private-key-here"
      }
    }
  }
}

2. Select Network

Use network name or chain ID:

  • Mainnet: etherlink or 42793
  • Testnet: etherlink-shadownet or 127823

Networks

NetworkChain IDRPCExplorer
Etherlink Mainnet42793https://node.mainnet.etherlink.comhttps://explorer.etherlink.com
Etherlink Shadownet127823https://node.shadownet.etherlink.comhttps://shadownet.explorer.etherlink.com

Native Currency: XTZ (18 decimals)

Common Operations

Check Balance

Get balance for 0x... on etherlink

Send Transaction

Send 0.1 XTZ to 0x... on etherlink

Read Contract

Call balanceOf on contract 0x... for address 0x... on etherlink

Get Block Info

Get latest block on etherlink

Etherlink-Specific Notes

Key Differences

  1. Native Currency: XTZ (Tez), not ETH
  2. No EIP-1559: Fee market not yet implemented - use legacy gas pricing
  3. Block Hashes: Computed differently (can't verify from header alone)
  4. Rate Limits: Public RPC limited to 1000 req/min

Supported Endpoints

  • ✅ eth_blockNumber, eth_chainId, eth_getBalance
  • ✅ eth_call, eth_estimateGas, eth_gasPrice
  • ✅ eth_sendRawTransaction, eth_getLogs
  • ✅ debug_traceTransaction
  • ❌ eth_subscribe (experimental only)
  • ❌ Filter endpoints (eth_newFilter, etc.)

Tezos L1 Bridge

Etherlink bridges to Tezos L1 for deposits/withdrawals. Bridge operations require Tezos tooling. See Etherlink Docs for details.

Testnet Faucet

Get testnet XTZ: https://shadownet.faucet.etherlink.com

Troubleshooting

"Unsupported network": Use correct network name (etherlink, etherlink-shadownet) or chain ID.

Rate limited: Public RPC has 1000 req/min limit. For production, run your own node.

Transaction failing: No EIP-1559 - don't set maxFeePerGas/maxPriorityFeePerGas.

Resources

Comments

Loading comments...