ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Collect Fees

v1.0.0

Check and collect LP fees from PancakeSwap V3 and Infinity (v4) positions. Use when user says "collect my fees", "claim LP fees", "how much fees have I earne...

⭐ 0· 60·0 current·0 all-time
by@pcs-bot
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name/description (collect LP fees) aligns with the included Node/JS and Solana scripts that read on-chain state and compute pending fees. However, the registry metadata claims 'Required env vars: none' while the included scripts require several environment variables at runtime (e.g., WALLET, CHAIN_ID, RPC, SOL_WALLET, optional CONCURRENCY). That mismatch is significant: consumers or an agent will not see the true runtime requirements from the registry entry.
ℹ
Instruction Scope
SKILL.md instructs only safe, read-only behaviour (no transaction execution) and includes explicit validation rules. The included scripts do appear to only read state (use eth_call/simulateContract, on-chain reads, and public explorer APIs). A telemetry/usage ping (curl to https://pancakeswap.ai/api/ping...) is performed at initialization — this is declared in the SKILL.md but may be unexpected to some users. Overall the instructions remain within the stated purpose, but require the user/agent to supply wallet and RPC inputs which are not declared in registry metadata.
✓
Install Mechanism
Install spec only uses brew formulas (curl, jq, foundry). These are common package sources on macOS/Linux. Installing 'foundry' (to provide cast) is heavier than strictly necessary for read-only node scripts but not inherently malicious. There are no downloads from arbitrary/untrusted URLs or opaque extract steps.
!
Credentials
The skill does not request private keys or secrets (good). However, the code requires wallet public addresses and RPC URLs as environment variables (WALLET, CHAIN_ID, RPC, SOL_WALLET), but the registry lists none — this is an under-declaration. The skill will leak the supplied public wallet addresses and RPC endpoints to PancakeSwap explorer APIs and pancakeswap.ai telemetry. No credentials for unrelated services are requested.
✓
Persistence & Privilege
The skill is not always-enabled, doesn't request system-wide persistence or modify other skills, and doesn't require privileged system changes. It is user-invocable and allowed to run autonomously (platform default).
What to consider before installing
What to consider before installing: - The skill appears to implement what it claims: Node and Solana scripts read on-chain positions and compute pending fees; they do not sign or send transactions. That means you should never provide private keys or seed phrases. Provide only public wallet addresses. - Important mismatch: the registry metadata claims 'no required env vars', but the included scripts require environment variables (WALLET, CHAIN_ID, RPC for EVM flows; SOL_WALLET for Solana). Expect to supply those to run the scripts. Confirm how the agent will obtain the wallet address (user input vs environment) and that the agent will validate the address formats as the SKILL.md requires. - Telemetry: the skill issues an asynchronous ping to https://pancakeswap.ai on startup. This is declared in SKILL.md, but be aware supplying your wallet address means that address (and chosen agent identifier) will be visible to pancakeswap.ai and to the PancakeSwap explorer APIs used by the scripts. - RPC endpoints: you must provide an RPC URL for the target chain. Use public, rate-limited, or provider-managed RPCs you trust. Do not give private node admin URLs or credentials. The SKILL.md states RPC URLs must come from a supported list — enforce that. - Installation: brew will install curl, jq, and foundry (cast). Foundry is a developer toolchain; if you don't want it installed, confirm the agent can run the Node scripts without 'cast'. - Review source: if you are not comfortable with the telemetry ping or disclosure of your public addresses to the PancakeSwap explorer, review/modify the SKILL.md and scripts before use. If possible, run the included Node/Solana scripts locally with a test public wallet to confirm behaviour. - If you want to proceed: do not provide private keys, verify RPC endpoints, and confirm the agent prompts you for the wallet address (rather than reading any hidden environment).
✗
references/fetch-infinity-positions.mjs:31
Environment variable access combined with network send.
✗
references/fetch-solana.cjs:24
Environment variable access combined with network send.
✗
references/fetch-v3-positions.mjs:39
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d8523dz6xm2t3332vyyck0583ha4z

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

OSmacOS · Linux
Binscurl, jq
Any bincast, python3, node, open, xdg-open

Install

Homebrew
Bins: curl
brew install curl
Homebrew
Bins: jq
brew install jq
Homebrew
Bins: cast
brew install foundry

Comments