Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Celo Agent Skills
v1.0.0End-to-end Celo development playbook (Feb 2026). Prefer viem for all client/transaction code (native fee currency support via CIP-64). Use thirdweb for wallet connection and React dApps. Foundry for smart contract development. Covers fee abstraction (pay gas in USDC/USDT/USDm), MiniPay Mini Apps, stablecoin integration, and AI agent infrastructure (ERC-8004 trust + x402 payments).
⭐ 0· 1.1k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Celo development playbook) matches the actual contents: extensive guidance for viem, thirdweb, Foundry/forge/cast, stablecoins, MiniPay, contract verification, and agent payments. Examples, RPC endpoints, and token addresses are Celo-specific and expected for this purpose.
Instruction Scope
The SKILL.md files are developer-facing how-to instructions and remain within the stated domain (dApp UI, wallets, fee abstraction, smart contracts, verification). They include code snippets and CLI examples that reference private keys, env vars, and commands to deploy/verify contracts — appropriate for a dev playbook but potentially sensitive if followed without care. No instructions tell the agent to read unrelated system files or exfiltrate data to unexpected endpoints.
Install Mechanism
The skill itself has no install spec (instruction-only), which is low risk. However, the instructions recommend running common developer installers in-line — e.g., curl -L https://foundry.paradigm.xyz | bash && foundryup — which downloads and executes a remote script. That is a standard Foundry installation approach but is a high-risk action if executed blindly; users should verify the source before running such commands.
Credentials
The skill does not request environment variables or credentials at install time, which is good. The documentation repeatedly shows using PRIVATE_KEY, ETHERSCAN_API_KEY, NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID, and examples that embed '0xYourPrivateKey' or call vm.envUint('PRIVATE_KEY'). These are expected for deployment and verification workflows, but they are sensitive — the skill's declared requirements omit them, so users must supply secrets manually. This is proportionate to the purpose but worth highlighting as sensitive.
Persistence & Privilege
always is false and user-invocable is true. The skill is instruction-only and does not request persistent privileges or attempt to modify other skills or system-wide settings.
Assessment
This collection is a coherent Celo development playbook and appears benign, but take these precautions before using any instructions:
- Secrets: Examples show using PRIVATE_KEY and API keys. Never paste real private keys into example files or share them in chat. Use environment variables, secure secret stores, or hardware wallets, and rotate keys after testing.
- Deployment verification: Verification and deployment commands require private keys and API keys; only run them from a trusted environment (CI with secrets configured) — not from a shared shell.
- Remote installers: The docs include curl | bash installer lines (Foundry). Verify the official source and the script contents before piping to sh; prefer package-managed or vetted installers when possible.
- Addresses & endpoints: The skill lists many token addresses and RPC endpoints. Independently verify any token address or adapter address on block explorers before sending funds.
- Test first: Use Sepolia/testnet addresses and faucets for development. Confirm behavior on testnet before mainnet.
If you plan to let an agent act on this guidance autonomously, restrict what secrets it can access and review any commands it proposes before execution. If you want, I can point out every place in the files where a secret, private key, or potentially risky command appears so you can audit them quickly.Like a lobster shell, security has layers — review code before you run it.
latestvk97dp1ac77bnteqg0jcc0evj8180wmqp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
