Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

chain-ops MGO

v1.0.0

Find and compare gas prices across multiple EVM chains to identify the cheapest option for transactions and contract deployments.

0· 114·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dlrjsdl200-byte/chain-ops-mgo.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "chain-ops MGO" (dlrjsdl200-byte/chain-ops-mgo) from ClawHub.
Skill page: https://clawhub.ai/dlrjsdl200-byte/chain-ops-mgo
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install chain-ops-mgo

ClawHub CLI

Package manager switcher

npx clawhub@latest install chain-ops-mgo
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description align with the listed endpoints (gas demo/basic/premium). However the metadata lacks a maintained homepage and the source is 'unknown', which reduces trust. The presence of paid endpoints (x402 on Base) is not justified by any required credentials or integration instructions in the SKILL.md.
Instruction Scope
SKILL.md only provides a base URL and three endpoints; it does not instruct the agent to read local files or request any environment variables. But it is vague: no example request payloads, no response schemas, no guidance about what transaction details (if any) should be sent, and no privacy guidance about what user data will be transmitted to the external API.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. The agent will call an external HTTPS API; nothing is written to disk by the skill itself.
Credentials
The skill requests no environment variables or credentials, which is proportionate. However SKILL.md mentions paid endpoints using an on-chain payment protocol (x402 on Base) but provides no mechanism for how the agent or user would make those payments (no wallet integration instructions, no API keys, no payment flow). That mismatch is unexplained and could cause unexpected behavior or confusion.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent presence or modify other skill configs. Autonomous invocation is allowed by default but is not combined with other high-risk factors here.
What to consider before installing
This skill appears to point at a multi-chain gas API and is instruction-only, but the publisher and homepage are missing and paid endpoints are mentioned without any payment or request details. Before installing or using it: 1) verify the API provider (check the GitHub repo and the mgo.chain-ops.xyz domain for legitimacy); 2) prefer calling the free demo endpoint first to confirm responses and format; 3) never provide private keys or wallet secrets — the SKILL.md does not request them, but paid on-chain calls could require a wallet outside the skill; 4) be cautious about allowing autonomous use that might trigger paid requests — restrict usage to user-invoked calls until you understand the payment flow; 5) if you rely on this for production decisions, ask the maintainer for API docs (request/response examples, rate limits, and a privacy policy) before trusting it.

Like a lobster shell, security has layers — review code before you run it.

defivk97e16s8bbsx093jcgkv861tk983bvg3evmvk97e16s8bbsx093jcgkv861tk983bvg3gasvk97e16s8bbsx093jcgkv861tk983bvg3latestvk97e16s8bbsx093jcgkv861tk983bvg3x402vk97e16s8bbsx093jcgkv861tk983bvg3
114downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

MGO — Multi-chain Gas Optimizer

Use this skill when the agent needs to find the cheapest EVM chain for a transaction, compare gas prices across chains, or optimize transaction costs.

When to use

  • "Which chain is cheapest for gas right now?"
  • "Compare gas prices across EVM chains"
  • "I want to send a transaction — where should I do it?"
  • "Find the cheapest chain to deploy a contract"
  • "How much will this transaction cost on Base vs Ethereum?"

Base URL

https://api.mgo.chain-ops.xyz

Endpoints

All paid endpoints use x402 protocol on Base (USDC). No API key needed.

GET /gas/demo — Free

Raw gas prices for 4 chains. Rate limited (10/hr per IP).

GET /gas/basic — $0.001 USDC

4-chain gas comparison with cheapest chain recommendation and savings calculation. Chains: Ethereum, Base, Optimism, Arbitrum

GET /gas/premium — $0.002 USDC

Full 9-chain comparison including BNB, Polygon, Avalanche, zkSync, Hyperliquid.

Payment (x402)

Protocol: x402 Network: Base (eip155:8453) Token: USDC

Links

Comments

Loading comments...