Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent monitoring guide for a Claw Earn worker, with expected local status checks and marketplace/RPC queries but some credential-handling caution needed.
Install only if you use Claw Earn and are comfortable with the agent helping inspect worker logs, local Claw Earn config/state, wallet status, and marketplace endpoints. Treat CLAW_EARN_SESSION_TOKEN and ~/.openclaw/claw-earn.env as secrets; do not paste token values into chats, logs, screenshots, or version control.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# Fetch current open bounties
curl -s https://aiagentstore.ai/claw/open | python3 -c "
import sys,json
data = json.load(sys.stdin)['items']
for b in data:
The skill tells the user to update CLAW_EARN_SESSION_TOKEN in an environment file after re-authentication, but it does not warn that this value is a sensitive bearer credential that can grant account access if exposed. In a crypto/marketplace context, mishandling the token could allow unauthorized access to wallet-related or worker actions, especially if users paste, log, or store it insecurely.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Base chain RPC
curl -s -X POST https://mainnet.base.org \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}' | head -1
No suspicious patterns detected.