on-chain analytics for evm contract

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for on-chain contract analytics and shows no destructive or credential-seeking behavior, but it relies on external services that may store or share the submitted analysis.

This appears safe to use for public smart-contract analytics. Before installing, be comfortable with a third-party Supabase/Dune-based service receiving the contract address, chain, and any ABI you provide, and avoid submitting private or proprietary ABI data.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user request can start a multi-minute external analysis and create Dune queries or dashboard outputs for the specified contract.

Why it was flagged

The artifact shows automated query generation and execution against Dune. This is purpose-aligned for analytics, but it is still remote action triggered by the skill.

Skill content
AI generates DuneSQL queries using `decode_evm_function_call()` ... All queries are executed on Dune
Recommendation

Use it for contracts you intentionally want analyzed, confirm the address and chain before invoking, and sanity-check important results against the linked Dune queries.

What this means

Trust in the analysis depends on the third-party hosted service, not on locally reviewable skill code.

Why it was flagged

The skill is instruction-only and delegates its core implementation to a hosted Supabase function. The external dependency is disclosed and purpose-aligned, but its server-side implementation is not visible in the provided artifacts.

Skill content
POST `https://esraarlhpxraucslsdle.supabase.co/functions/v1/onchain-analysis`
Recommendation

Treat the endpoint as a third-party service and avoid submitting information you would not want that service to receive.

What this means

Public contract addresses are usually low sensitivity, but a manually supplied ABI for an unverified contract or the user's analysis interest could be exposed to external services or shared links.

Why it was flagged

The request sends the contract address, chain, and optional ABI to an external service, and the response may include a shared dashboard link.

Skill content
`contractAddress`, `chain`, `abi` ... `dashboardUrl`: `https://onchainwizard.ai/shared/abc123-uuid`
Recommendation

Only provide public or non-sensitive ABI data, and assume generated dashboard and Dune links may be accessible outside the chat.