Gasless Crosschain Executor
Analysis
This skill is aimed at wallet-based crypto swaps and includes good safety instructions, but it references missing helper code and underdeclares the sensitive credentials and execution authority needed.
Findings (9)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Choose provider mode. The choice follows from observable state; do not ask the user.
The skill intentionally constrains the agent to pick a provider path automatically instead of asking the user. This is framed as a safety decision tree, but users should know the skill may override open-ended provider choice.
Plan, validate, sign, submit, and monitor EVM swaps with local-only key custody.
The workflow includes signing, submitting, and monitoring blockchain swaps. These are high-impact tools, but the instructions also require exact plan review and explicit authorization before real execution.
running `./scripts/setup.sh` once to materialize the Python venv and the Fusion+ Node deps
The submitted manifest contains only markdown/reference files and no scripts, requirements file, package file, or tests. Referencing missing setup and helper code creates a provenance gap for a high-impact wallet execution workflow.
python3 -m venv .venv && source .venv/bin/activate pip install -r requirements.txt # 2. (optional) node deps for the Fusion+ helpers cd examples && npm install && cd ..
The artifact is declared instruction-only with no install spec, but the documentation instructs users to create environments and run pip/npm installs from files and directories that are not present in the submitted package.
Cross-chain swaps are irreversible and expensive to mess up.
A wrong route, approval, token address, or recipient can propagate into irreversible on-chain or cross-chain effects. The skill recognizes this and includes guardrails, but the impact remains high.
The agent never sees a key.
The package makes strong safety claims, but the submitted artifact contains no helper code to verify the claimed local signer, key isolation, validator, file permissions, or tests. In a wallet-execution skill, unsupported safety claims can lead users to over-trust the workflow.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Required env vars: none Env var declarations: none Primary credential: none
The registry declares no credential contract, while the supplied capability signals include wallet/signing/sensitive-credential needs and the documentation asks for provider API keys and local signer references. That underdeclares the privilege needed to operate the skill.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Persist only non-secret data: - normalized execution plan - plan hash - raw quote response with secrets redacted - provider name and endpoint - token and chain metadata
The skill intentionally persists transaction planning and provider context. This is useful for auditability, but persisted route metadata and provider responses should not become an unreviewed authority for later signing.
`examples/submit_fusion_plus.mjs` — POSTs `submitPayload + signature` to the relayer.
The workflow sends signed payloads and provider data to external relayer/status APIs. This is expected for 1inch execution, but users should understand that signatures and order metadata leave the local machine.