Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Switchboard Skills
v1.0.0Autonomous operator for Switchboard on-demand feeds, Surge streaming, and randomness. Designs jobs, simulates via Crossbar, and deploys/updates/reads feeds across Solana/SVM, EVM, Sui, and other Switchboard-supported chains—with user-controlled security, spend limits, and allow/deny lists.
⭐ 2· 798·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the instructions: the SKILL.md describes designing, simulating, deploying, updating, and reading Switchboard feeds across multiple chains and references appropriate SDKs and patterns. There are no unexpected external credentials, binaries, or config paths requested that would be unrelated to on-chain operator tasks.
Instruction Scope
The instructions are relatively scoped and security-conscious: they require obtaining an explicit OperatorPolicy before signing/moving funds, never printing secrets, and preferring keystores/secret managers. The skill does describe reading keys from file paths, env vars, or remote signers if the user specifies them — which is expected for a blockchain operator, but this is the primary area where user caution is required (ensure the agent only accesses keys you explicitly allow).
Install Mechanism
Instruction-only skill with no install spec or code files. No code is downloaded or written to disk as part of the skill itself, which reduces installation risk. The SKILL.md recommends npm packages/CLI tools for developer workflows, but the skill does not attempt to install them automatically.
Credentials
The skill declares no required environment variables or primary credential. It documents possible key sources (file, keystore, env var, remote signer) as user-configurable options; that is proportionate to its function. There are no unrelated secrets requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform persistence. It allows autonomous invocation (the platform default), but the SKILL.md requires explicit OperatorPolicy and user consent for signing/execution. If the user grants 'full_autonomy' and provides keys, the agent could act on chain—this is expected behaviour but requires user caution.
Assessment
This skill is internally consistent for operating Switchboard feeds, but treat it like any tool that can sign on-chain transactions: only use it if you trust the skill's author/source. Before granting signing authority or providing keys: (1) prefer hardware wallets or a remote signer (never paste seed phrases or full key files into chat), (2) start in read_only or plan_only mode and test on devnet/testnet, (3) set strict spend limits and allowlists in the OperatorPolicy, (4) avoid persisting secrets and prefer secret managers, and (5) review any concrete transaction steps the agent proposes before approving. If the skill’s origin remains unknown, exercise extra caution and avoid supplying mainnet signing keys.Like a lobster shell, security has layers — review code before you run it.
latestvk978kb0nphcctnj6aga92azgsh80xsfc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.