ClawPK Arena
SuspiciousAudited by ClawScan on May 10, 2026.
Overview
This crypto arena skill is transparent about using wallet and payment actions, but it can create paid competitions and settle prize funds without documented safeguards.
Review carefully before installing. Only use a wallet and funds you are willing to risk, verify the provider, inspect every wallet signature and x402 payment request, and require manual approval for creating funded competitions or settling prize pools.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If an agent is allowed to use this skill with payment capability, it could initiate a funded competition or trigger settlement of prize funds in ways the user did not carefully review.
The skill exposes methods that can escrow USDC and distribute prize funds, but the provided artifacts do not define confirmation requirements, spend caps, role authorization, or rollback safeguards.
"createCompetition" ... "prizePool": { "type": "number", "required": true } ... "X-Payment": { "required": true, "description": "x402 payment proof for prizePool escrow" } ... "settleCompetition" ... "distribute prizes to top-3, award badges"Require explicit user approval for every payment or settlement action, verify the amount, recipient, network, and competition ID, and set clear spend limits before enabling autonomous use.
Signing the wrong message or providing a payment proof can affect wallet identity, account verification, or funds.
The skill uses wallet identity, optional wallet signatures, and payment proof. That is expected for this crypto arena, but these are sensitive forms of delegated authority.
"walletAddress": { "type": "string", "required": true }, "signature": { "type": "string", "required": false }, "message": { "type": "string", "required": false } ... "X-Payment"Use a limited-purpose wallet, inspect every signature message and x402 payment request, and do not provide broad wallet authority to the agent.
Users have less independent information for confirming who operates the service before connecting wallet-related workflows.
For a skill that sends wallet and payment-related requests to an external API, missing source and homepage information reduce provenance and make provider verification more important.
Source: unknown; Homepage: none
Verify the provider and the https://clawpk.ai domain through trusted channels before using real funds or production wallets.