ZetaChain Omnichain Helper
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to be a straightforward ZetaChain helper that queries public blockchain APIs, but users should verify its hardcoded network endpoints and any financial action suggestions before relying on them.
This skill looks generally safe for public blockchain lookups, but review the RPC providers, install Python dependencies from trusted sources, and independently verify any deposit or TSS address before moving funds.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Wallet addresses and CCTX hashes are public-chain identifiers, but querying them through third-party providers can still reveal what addresses or transactions the user is interested in.
The script uses third-party public RPC/API endpoints to process supplied addresses and transaction hashes, so those providers may observe the queried blockchain identifiers and caller metadata.
"Ethereum": ["https://eth.llamarpc.com", "https://rpc.ankr.com/eth"], ... "Bitcoin": ["https://blockstream.info/api"]
Only query addresses or transactions you are comfortable exposing to these providers, or modify the script to use RPC endpoints you trust.
The skill may fail unless Python and the requests package are already available, and users may need to install that dependency themselves.
The script depends on the Python requests package, while the supplied install information says there is no install spec or declared required binaries. This is an installation completeness issue, not evidence of hidden behavior.
import requests
Before installing or running, confirm the Python environment and install dependencies from trusted package sources.
If a user treats the output as authoritative, they might move funds based on a hardcoded address or recommendation without independent verification.
The navigation report can recommend a high-priority financial action and display a hardcoded target address. The script does not execute transfers, but users could act on the recommendation.
actions.append({"priority": "HIGH", "action": "Unlock BTC Liquidity", "target_tss": ZETA_CONFIG["TSS_ADDRESSES"]["BTC"]})Verify any TSS or deposit address against official ZetaChain sources before sending funds, and treat generated actions as informational rather than instructions.