Secret argv exposure
Critical
- Finding
- Instructions pass high-value credentials through process argv.
web3-ops
Security checks across static analysis, malware telemetry, and agentic risk
Overview
No risk analysis has been recorded yet.
Publisher note
`A production-grade, state-of-the-art Web3 Agent Skill package built with Node.js and Ethers.js v6. Designed to execute EVM transactions, same-chain swaps, cross-chain bridges, NFT mints, and wallet portfolio checks. It can be run as a standalone CLI tool or integrated directly as a plugin/skill for AI agents (such as the OpenClaw Telegram Bot). Quick Start & Installation You can install this skill in three different ways depending on your preference: Opsi A: Automated NPX Installer (Recommended) You can install this skill directly using our GitHub repository shorthand (no publishing required): npx github:perasyudha/skill-web3 Note: If the package has been published to the npm registry under openclaw-web3-ops, you can also use: npx openclaw-web3-ops To install to a custom path instead of the default ~/.agents/skills/web3-ops, pass the custom path as an argument: npx github:perasyudha/skill-web3 ./my-custom-path/web3-ops Opsi B: Conversational Install via AI Agent If you are running an AI Agent (like Claude Code, Cursor, or OpenClaw) with terminal capabilities, simply paste the following prompt in the chat: "Please install the web3-ops skill from https://github.com/perasyudha/skill-web3.git to my skills directory at ~/.agents/skills/web3-ops" The agent will automatically clone, setup the folder structure, and install dependencies. Opsi C: Manual Setup Clone this repository and install the dependencies manually: git clone https://github.com/perasyudha/skill-web3.git cd skill-web3 npm install 2. Wallet Configuration Copy .env.example to .env and configure your credentials: cp .env.example .env Open .env and fill in your private key or seed phrase: PRIVATE_KEY="0x..." # Or use mnemonic: # MNEMONIC="word1 word2 ... word12" # Block Explorer API Keys (Highly Recommended for Portfolio Auto-detection) BASESCAN_API_KEY="your_basescan_key" ETHERSCAN_API_KEY="your_etherscan_key" ARBISCAN_API_KEY="your_arbiscan_key"
Static analysis
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.