Mamo
v1.0.1Interact with Mamo DeFi yield strategies on Base (Moonwell). Deposit/withdraw USDC, cbBTC, MAMO, or ETH into automated yield strategies. Check APY rates and account status.
⭐ 0· 1.3k·0 current·0 all-time
byAna@anajuliabit
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code and documentation implement a CLI to deploy/operate per-user Mamo strategy contracts on Base and to query APYs — which matches the skill name/description. However, the skill metadata in the registry claims no required env vars while both SKILL.md/README and the code require a private key (MAMO_WALLET_KEY) and optionally MAMO_RPC_URL. That omission is an incoherence between declared requirements and actual needs.
Instruction Scope
SKILL.md instructs installing and exporting a private key (MAMO_WALLET_KEY) and running the CLI commands (create, deposit, withdraw, status). The runtime code will: load a .env file from the script directory if present, read MAMO_WALLET_KEY and MAMO_RPC_URL from environment, sign SIWE messages and on-chain transactions, call Mamo backend endpoints (mamo-queues.moonwell.workers.dev, mamo-indexer.moonwell.workers.dev), and read/write ~/.config/mamo/auth.json and strategies.json. These actions are within the expected scope for a wallet-using CLI, but they do involve reading local .env files and persistent storage and transmitting signed messages/auth payloads to external APIs — all high-impact operations for a wallet-enabled tool and worth explicit prominence in the metadata/instructions.
Install Mechanism
No remote install script is embedded in the skill bundle; SKILL.md instructs running npm install and executing the included Node script. All dependencies are standard npm packages (viem, siwe, commander, dotenv). There are no downloads from obscure URLs or archives in the install spec. Risk from installation itself is low, but running npm install pulls third-party packages as usual.
Credentials
The functionality legitimately requires a signing key (MAMO_WALLET_KEY) and optionally an RPC URL, but the registry metadata lists no required env vars and the skill manifest did not declare the private key as the primary credential. Asking for a raw private key (and providing code that will read a .env file in the script dir) is expected for a CLI that signs txs, but is high-risk and should be declared clearly. The code stores auth tokens locally (~/.config/mamo/auth.json), which is expected but should be noted. No unrelated credentials are requested.
Persistence & Privilege
The skill writes persistent configuration to ~/.config/mamo (strategies.json, auth.json) and may store API auth tokens returned from the backend. always: false (not force-included). The skill can be invoked autonomously (platform default). If you set MAMO_WALLET_KEY in the environment for the agent, the skill gains the ability to sign and submit transactions autonomously — a meaningful risk that depends on whether you allow the agent to run skills without manual approval.
Scan Findings in Context
[pre-scan-injection] expected: No injection signals were detected. The CLI reads a .env and writes to ~/.config/mamo — this is expected for a wallet CLI but increases the impact of any compromise.
What to consider before installing
What to consider before installing/use:
- Metadata mismatch: the registry lists no required env vars but the CLI requires MAMO_WALLET_KEY (your wallet private key). That omission is an integrity/visibility problem — treat the private key requirement as real even if not declared. Do not set your main/private key in the environment for this skill.
- Use a dedicated hot wallet: if you try the tool, create a separate wallet with limited funds and use that key only. Never expose your main wallet private key in environment variables or committed files.
- Prefer ephemeral signing: if possible, avoid placing a raw private key in plaintext. Use a hardware signer, a JSON-RPC signer with restricted permissions, or an ephemeral test key.
- Review endpoints & addresses: the code posts SIWE messages and other requests to mamo-queues.moonwell.workers.dev and mamo-indexer.moonwell.workers.dev and interacts with on-chain contract addresses included in references. Verify these endpoints and contract addresses independently (official docs/repos) before trusting them.
- Be aware of persistence: the CLI writes ~/.config/mamo/auth.json and strategies.json. Inspect these files if you run the tool to ensure no sensitive secrets are stored accidentally.
- Autonomy risk: the platform allows the agent to invoke skills autonomously. If you set MAMO_WALLET_KEY in the agent environment, an autonomous agent could sign/send transactions without explicit per-transaction confirmation. If you must provide a key, prefer manual invocation or deny autonomous invocation for this skill.
- Audit before use: the repository contains many source files implementing blockchain calls; if you plan to use real funds, have someone you trust audit the code (or run the official published mamo-cli from Moonwell's official repo/registry rather than an unknown registry copy).
- Dry-run/testing: use the CLI's dry-run mode and test on a non-mainnet environment (or with tiny amounts) first. Don't store the private key in a repository or shared machine account.
If you want, I can list precise code locations where the private key is read, where network calls happen, and where files are written so you (or an auditor) can inspect them quickly.Like a lobster shell, security has layers — review code before you run it.
latestvk973gwqt2aysk51v838drn052d80jx42
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🐮 Clawdis
Binsnode