Dao Treasury Literacy

AdvisoryAudited by Static analysis on May 7, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

A user might be confused by the capability signal and think wallet access or sensitive credentials are needed, even though the skill documentation says they are not.

Why it was flagged

These supplied capability signals would be high-impact if accurate, but the reviewed skill files contain no code, no install mechanism, no required credentials, and explicit instructions not to connect wallets or sign transactions.

Skill content

- requires-wallet
- can-sign-transactions
- requires-sensitive-credentials

Recommendation

Do not provide seed phrases, private keys, wallet passwords, signing material, or wallet access to this skill. The publisher should correct the capability metadata/signals if they are visible to users or installers.