Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/monitor.cjs:84
Security audit
clawpi-redpacket-monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill's declared metadata omits sensitive local credentials and binaries the code actually requires (it reads a local wallet JWT and shells out to fluxa-wallet/openclaw), so its operational requirements don't match what's declared.
Before installing or running this skill: 1) Inspect ~/.fluxa-ai-wallet-mcp/config.json and confirm what agentId.jwt contains; if it is a long-lived wallet token, treat it as a secret—do not expose it to untrusted code. 2) The skill shells out to fluxa-wallet, openclaw, and curl but does not declare those binaries—ensure you have and trust those tools and the skill's author. 3) The script includes a hardcoded status path (/Users/xufan65/...) which may be incorrect or attempt to read another user's files; update paths to a safe location you control. 4) If you will run the skill, run it in a sandboxed environment first (or with limited wallet credentials) and rotate/revoke any JWTs used for testing. 5) If you do not trust the author or cannot verify the FluxA wallet token scope, do not run the skill. If you want to proceed, ask the author to: declare required credentials and binaries in metadata, remove hardcoded user paths, and document token scope and lifetime so you can make an informed decision.
Static analysis
Detected: suspicious.dangerous_exec