Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Debank Skill

v1.0.0

Query blockchain wallet data—balances, DeFi positions, tokens, NFTs, transactions, gas prices, and token approvals—across EVM chains via DeBank API.

0· 107·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lolieatapple/debank-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Debank Skill" (lolieatapple/debank-skill) from ClawHub.
Skill page: https://clawhub.ai/lolieatapple/debank-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install debank-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install debank-skill
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name/description (querying wallets via DeBank) matches the SKILL.md: it instructs using the debank-cli to call DeBank Pro API endpoints. There are no unrelated credentials, binaries, or actions requested that don't fit the stated purpose.
Instruction Scope
The runtime instructions tell the agent to check for and/or install a global npm package (debank-cli), run the CLI commands, and inspect/set the CLI config (which is stored at ~/.debank-cli/config.json). These actions are expected for a CLI-based integration, but they do grant the skill the ability to run shell commands and read/write a local config file containing the API key — behavior the user should consciously accept.
Install Mechanism
There is no formal install spec in the registry; the SKILL.md instructs a user/agent to run `npm install -g debank-cli`. Installing a global package from the public npm registry is a reasonable installation approach for a CLI, but npm packages run code during install and are a moderate risk if the package or its maintainers are untrusted. No downloads from arbitrary URLs or archive extraction are requested.
Credentials
The skill requires a DeBank Pro API key (documented in SKILL.md and stored by the CLI). No other environment variables or unrelated credentials are requested. Requiring the API key is proportional to the skill's function.
Persistence & Privilege
The skill does not request elevated persistence (always:false) and does not ask to modify other skills or system-wide agent settings. It only uses the CLI's own config file to store the API key, which is normal for this workflow.
Assessment
This skill appears to do what it says: it uses the debank-cli to query DeBank. Before installing or running it, consider these practical steps: 1) Manually review and install debank-cli yourself rather than letting an automated agent run npm -g, because npm installs execute code during install. 2) Verify the npm package and repository (maintainers, recent activity, and checksums) to reduce supply-chain risk. 3) Provide a scoped/limited DeBank Pro key if possible and understand that the CLI will save it to ~/.debank-cli/config.json — protect that file (permissions) and avoid sharing the key elsewhere. 4) Prefer to run the CLI locally in a controlled environment (container, VM) if you are concerned about executing third‑party npm code. 5) If you want higher assurance, request the skill author publish an explicit install manifest (signed release or pinned package version) or provide an audited binary instead of leaving installation to an automated agent. If the SKILL.md had asked for unrelated credentials, contained external upload endpoints, or required downloads from arbitrary URLs, the assessment would be more suspicious.

Like a lobster shell, security has layers — review code before you run it.

latestvk9766w5c9x8wek94r7mjgfa7r983nrcg
107downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

DeBank CLI Skill

This skill uses debank-cli to query blockchain data via the DeBank Pro API.

Skill repo: https://github.com/lolieatapple/debank-skill CLI repo: https://github.com/lolieatapple/debank-cli

Prerequisites

Ensure debank-cli is installed globally:

!`which debank 2>/dev/null || echo "NOT_INSTALLED"`

If NOT_INSTALLED, install it:

npm install -g debank-cli

Then check if the API key is configured:

!`debank config show 2>&1`

If no API key is configured, ask the user for their DeBank Pro API key (obtain at https://cloud.debank.com/) and run:

debank config set-key <THE_KEY>

Available Commands

Wallet Queries

CommandDescription
debank user balance <address>Total USD balance across all chains
debank user tokens <address> [chain_id] [--all]Token balances (optionally filter by chain, --all includes dust)
debank user protocols <address> [chain_id]DeFi protocol positions with full detail (supply, borrow, rewards)
debank user nfts <address> [chain_id]NFT holdings
debank user history <address> [chain_id] [count]Transaction history (max 20 per page)
debank user approvals <address> <chain_id>Token approval/allowance list
debank user chains <address>Chains where this address has activity

Token Queries

CommandDescription
debank token info <chain_id> <token_id>Token details (name, symbol, decimals, price)
debank token price <chain_id> <token_id> [YYYY-MM-DD]Current or historical price
debank token holders <chain_id> <token_id> [limit]Top holders (default 20)

Chain & Gas

CommandDescription
debank chain listAll supported chains
debank chain info <chain_id>Chain details
debank gas <chain_id>Gas prices (slow/normal/fast)

Config & Account

CommandDescription
debank config set-key <key>Save API key to ~/.debank-cli/config.json
debank config showShow current API key source and masked value
debank config remove-keyRemove saved API key
debank account unitsCheck remaining API units and usage

Common Chain IDs

eth, bsc, matic, arb, op, base, avax, ftm, xdai, cro, linea, scroll, zksync

Native Token Addresses

For native tokens (ETH, BNB, etc.), use: 0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

Handling the Request

If the user provides $ARGUMENTS, parse them and run the appropriate debank command directly.

Otherwise, determine the best command based on the user's natural language request:

  • "What's in this wallet?" / "Show me the portfolio" → debank user balance + debank user tokens + debank user protocols
  • "DeFi positions" / "protocol positions" → debank user protocols
  • "Token balances" → debank user tokens
  • "NFTs" → debank user nfts
  • "Transaction history" → debank user history
  • "Token price" / "How much is X?" → debank token price
  • "Gas price" → debank gas
  • "Approvals" / "allowances" → debank user approvals

For a comprehensive portfolio overview, run balance, tokens, and protocols in sequence to give a full picture.

Present the results clearly. When showing financial data, highlight the most significant positions and totals.

Comments

Loading comments...