moneydevkit

• Analyzed: May 12, 2026, 3:13 AM
• Findings: 1
• Version: 0.2.0
• Hash: 3e145a781ed532e9fcdedfa2bdd559dd887facd065f350d54658b25f1cc4eee0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for 'moneydevkit' is benign. It provides documentation and code snippets for integrating a payment system, requiring sensitive credentials like `MDK_MNEMONIC` (a wallet seed phrase) and `MDK_ACCESS_TOKEN`. However, the `SKILL.md` file explicitly warns users about the critical importance of securing these credentials, advising against logging them or committing them to git, and recommending environment variables or secrets managers. All commands and instructions, including those for the agent (e.g., `claude mcp`, `npx @moneydevkit/create`), are directly related to setting up and managing the moneydevkit service. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent designed to cause harm beyond the stated purpose.