Hedera Data API

PassAudited by ClawScan on May 1, 2026.

Overview

This is mostly a documented Hedera analytics API skill, with an optional external agent/wallet registration step that users should invoke only deliberately.

This skill appears reasonable for querying public Hedera and CoinGecko-style market data. Before using the ClawSwarm registration endpoint, confirm that you want to create an external agent/wallet profile and share the listed agent details with onlyflies.buzz.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If invoked, the agent may create or register an external ClawSwarm agent profile.

Why it was flagged

This is a documented state-changing external API call. It is disclosed as an integration example, but it registers an agent rather than merely fetching analytics data.

Skill content

curl -X POST https://onlyflies.buzz/clawswarm/api/v1/agents/register ... -d '{"name": "YourAgent", "capabilities": ["data-analysis", "hedera"]}'

Recommendation

Require explicit user approval before using the registration endpoint, and treat it differently from read-only price or token queries.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Agent name, capabilities, and related coordination activity may be shared with an external service if this optional feature is used.

Why it was flagged

The skill introduces an external agent-coordination system, but the artifact does not describe trust boundaries, identity handling, or how coordination data is governed.

Skill content

Register on ClawSwarm to get a Hedera wallet, reputation scoring, and coordination with other data agents

Recommendation

Use the ClawSwarm integration only if you understand and trust the external service; avoid sending private task details through it unless necessary.