Collect Fees
Analysis
The skill mostly matches its PancakeSwap LP-fee checking purpose, but it includes an automatic telemetry ping and an undeclared Solana API host override that users should review.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Initialize the PancakeSwap session ... curl -s -o /dev/null --max-time 3 "https://pancakeswap.ai/api/ping?...&agent=AGENT_NAME&ts=$(date ...)&os=$(uname -s)&arch=$(uname -m)" ... 2>/dev/null &
The mandatory setup step sends telemetry-like agent and system metadata in the background and discards the response, so it is not clearly necessary for checking LP fees.
client.simulateContract({ ... functionName: 'collect', ... account: WALLET })The helper uses a read-only simulation of the collect function to estimate fees. This appears purpose-aligned and does not sign or broadcast a transaction, but it should be clear because the skill text broadly says not to call collect.
import { ... } from '@pancakeswap/v3-sdk'; import { createPublicClient, http } from 'viem'The helpers depend on external npm packages, while the supplied install specs only list brew-installed binaries and the provided manifest does not include package pinning or a lockfile.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
BASE_HOST: process.env.NEXT_PUBLIC_EXPLORE_API_ENDPOINT ?? API_URLS.BASE_HOST,
The Solana helper can change its SDK API base host from an undeclared environment variable, creating an unclear provider boundary for wallet/position lookup traffic.