ClawSea NFT Marketplace

ReviewAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is coherent for ClawSea NFT browsing and optional trading, but users should treat wallet signing and marketplace write actions as high-impact.

Safe read-only browsing does not require secrets. Only configure RPC access and wallet signing if you intentionally want the agent to trade, and use a dedicated limited bot wallet with explicit human review for every value-moving action.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken or poorly reviewed action could buy, list, cancel, or fulfill an NFT transaction using the configured bot wallet.

Why it was flagged

The skill includes high-impact marketplace and blockchain actions, but it also explicitly requires confirmation and frames these actions as optional trading flows.

Skill content

Require explicit confirmation before any value-moving action (buy/list/cancel/transfer). ... Execute onchain tx from bot wallet.

Recommendation

Keep the skill read-only unless trading is intended; require human confirmation with decoded transaction details, exact chain, contract, token ID, price, and fees before broadcasting.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone or anything with access to the configured signer or private key could potentially spend funds or move NFTs from the bot wallet.

Why it was flagged

A bot wallet private key or external signer grants transaction authority; the documentation discloses this and recommends safer handling, so this is a purpose-aligned credential note rather than a concern.

Skill content

Preferred: external signer / wallet provider (no raw private key in agent env) ... If unavoidable: `BOT_WALLET_PRIVATE_KEY` in a secure secret store only

Recommendation

Prefer an external signer, use a dedicated low-balance bot wallet, avoid pasting keys into chat, and rotate/remove the key when trading is no longer needed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less external context for verifying who maintains the skill or whether the documented ClawSea integration is official.

Why it was flagged

The registry does not provide a source repository or homepage for provenance. There is no install code here, so this is limited to a provenance note.

Skill content

Source: unknown; Homepage: none

Recommendation

Verify the marketplace domain and maintainer through trusted channels before enabling wallet signing or real trades.