Lsp28 Grid
Analysis
The skill appears purpose-aligned, but it requires a controller private key and sends mainnet transactions that change a Universal Profile grid while those sensitive permissions are under-declared.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
const tx = await keyManager.execute(setDataCalldata);
console.log('Transaction:', tx.hash);
const receipt = await tx.wait();The script sends the encoded setData call through the Key Manager and waits for confirmation. There is no built-in confirmation prompt, dry run, chain check, target-profile check, or validation before performing the mainnet mutation.
const { ethers } = require('ethers');The script depends on the ethers package, but the supplied registry information says there is no install spec and the manifest does not include a package file or lockfile.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
const PRIVATE_KEY = process.env.UP_PRIVATE_KEY || 'YOUR_CONTROLLER_PRIVATE_KEY'; ... const wallet = new ethers.Wallet(PRIVATE_KEY, provider);
The script uses a Universal Profile controller private key to sign transactions. This is high-impact account authority, yet the registry metadata declares no primary credential or required environment variables.