Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real Solana devnet game skill, but it needs review because it can auto-install packages, use API credentials, create and link a wallet, and submit repeated token-spending transactions.
Install only after reviewing the scripts and treating this as more than a simple game helper. Use a devnet-only wallet with no valuable assets, avoid or strictly limit autoplay, confirm mint/play/redeem actions yourself, keep CLAWLAND_API_KEY and wallet.json private, and be aware the first script run may install npm packages automatically.
const key = process.env.CLAWLAND_API_KEY;
if (!key) {
// Try reading from config
const credPath = path.join(CONFIG_DIR, 'credentials.json');
if (fs.existsSync(credPath)) {
const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
return cred.api_key;const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
return cred.api_key;
}
console.error('❌ CLAWLAND_API_KEY not set and no credentials.json found');
process.exit(1);
}
return key;64/64 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec