Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
spherico-agent
v0.0.2End-to-end Bitnow network API workflows for AI agents. Covers wallet signature-based authentication, on-chain top-up monitoring, consumer API key lifecycle (...
⭐ 0· 128·0 current·0 all-time
byJerry@viyozc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes Bitnow gateway workflows (wallet SIWE-style auth, consumer API key lifecycle, balance checks) which align with the skill description, but the published package name (spherico-agent) and the SKILL.md internal name (bitnow-agent) mismatch and there is no homepage or source URL — this reduces provenance and makes it harder to trust the publisher.
Instruction Scope
Runtime instructions are curl/CLI-oriented and stay within API interactions (no arbitrary file reads or system-wide config access). However the flows rely on user-produced EVM signatures; signing messages can grant on-chain or off-chain state changes (e.g., declaring a parent, creating session tokens). The skill does not request private keys directly, but it can instruct users to perform sensitive signing operations — a potential social-engineering risk if the gateway URL or message content are malicious or tampered with.
Install Mechanism
Instruction-only skill with no install spec or code files (lowest install risk). Nothing is downloaded or written to disk by the skill itself.
Credentials
The skill declares no required environment variables, credentials, or config paths; all auth is performed via user wallet signatures and ephemeral session tokens or API keys the gateway returns. There are no disproportionate credential requests in the metadata.
Persistence & Privilege
always is false and the skill does not request persistent system-level privileges. Autonomous invocation is allowed (platform default) but the skill itself does not ask for elevated or persistent presence.
What to consider before installing
This skill appears to document legitimate Bitnow API flows, but exercise caution before using it: 1) Confirm the correct gateway/base URL from an official source — do not trust a URL provided only inside the skill. 2) Do not paste or otherwise provide private keys or seed phrases to the agent; perform all signature operations in your own wallet (preferably hardware wallets) and verify the exact message being signed. 3) Be wary of signing anything that grants permissions (declaring parents, delegations) without verifying its effect on-chain or with official docs. 4) Because the package has no homepage/source and the internal name differs from the registry name, prefer to obtain official API docs from the service operator and test flows in a staging environment first. 5) If you plan to generate or store API keys, treat them as secrets: store them in a secure vault and rotate/revoke as needed. If you want a higher-confidence assessment, provide the gateway URL and the publisher/source repository so I can check authenticity and compare to official docs.Like a lobster shell, security has layers — review code before you run it.
betavk9735zp3v2er1jrvcwkz18jjnh832ncklatestvk9715vv93msqkdha5dzzh2vc3x836dnzv2vk9715vv93msqkdha5dzzh2vc3x836dnz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.