Bsc Dev Monitor Skill

• Analyzed: May 10, 2026, 7:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2716db6c396ab77794519b80accce99d8025f66096ee251f250c47b570cdb435
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains multiple instances of hardcoded sensitive credentials, including a ClawHub account email and password ([e-mail] / hefang198511633), a SkillPay API key, and a BSCScan API key. These are found in auto-deploy.js, DEPLOYMENT-GUIDE.md, READY-TO-DEPLOY.md, and the various index.js versions. While the core logic for monitoring BSC wallet activity appears to align with the stated purpose, the inclusion of these secrets and the presence of an automated deployment script (auto-deploy.js) using them is a significant security risk. No evidence of intentional data exfiltration or malicious behavior targeting the user was identified.