Clawpay

• Analyzed: May 12, 2026, 3:19 AM
• Findings: 1
• Version: 0.1.0
• Hash: f4205c65dafb4015b3050d049383a02726beae349ae8d9b8301633c25ca08e8d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to directly handle and use a private key (via `process.env.WALLET_KEY` or hardcoded) to perform financial transactions on the blockchain. The `SKILL.md` file contains a JavaScript script (`send-private.mjs`) that uses this private key to sign messages and transfer USDT to an external service (`https://clawpay.dev`). While the stated purpose is to facilitate private payments, requiring an agent to manage and utilize a private key for direct blockchain transactions represents a very high-risk capability and broad permission, even without clear evidence of intentional malicious redirection of funds within the provided code.