Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Bitget Wallet Skill.Disabled
v1.0.0Wallet Manage, Interact with Bitget Wallet API for crypto market data, token info, swap quotes, and security audits. Use when the user asks about wallet, tok...
⭐ 0· 52·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (wallet, market data, swaps, security audits) align with the shipped artifacts: Python CLI scripts for API calls, signing, make/sign/send, and x402 payments plus comprehensive docs. No unrelated cloud credentials or unrelated binaries are requested.
Instruction Scope
SKILL.md instructs the agent to run the provided Python CLIs (quote, confirm, make-order, sign, send, x402 pay) and to generate/store a BIP-39 mnemonic for signing. That scope is expected, but the doc also instructs the agent to re-install/replace local skill files from a remote GitHub raw URL when an update is accepted — which grants the skill implicit permission to replace executable logic on disk. Also, the skill both enforces human-in-the-loop rules and includes one-shot scripts (order_make_sign_send.py) that enable full autonomous make+sign+send if given private keys; this is a capability/constraint mismatch that could be abused if the agent or environment is misconfigured.
Install Mechanism
There is no formal install spec (instruction-only), so the skill runs local Python scripts — lowest install risk by itself. However SKILL.md recommends fetching CHANGELOG from raw.githubusercontent.com and, on user approval, re-installing (replace all local skill files) from the repo main branch. Automatically pulling and overwriting code from a remote repo at runtime is high-risk unless the agent validates signatures or the operator enforces strict provenance policies.
Credentials
The skill declares no required env vars or external credentials, which is consistent. However its legitimate operation requires access to highly sensitive secrets: a BIP-39 mnemonic and derived private keys (passed to signing scripts via CLI args or from secure storage). That is proportionate to the stated purpose (wallet signing), but these are high-value secrets — the skill also documents storing the mnemonic and never printing it, yet actual scripts accept private key flags which, if misused or logged, could expose keys. Operators should prefer hardware/external signing or strictly controlled secure storage.
Persistence & Privilege
always:false (good). The skill can be invoked autonomously (platform default). The combination of autonomous invocation + scripts that can perform make+sign+send (if provided keys) + instructions to re-install code from GitHub increases blast radius. There is no built-in gate in the SKILL.md that prevents the agent from performing a full swap flow programmatically if keys are available — the doc relies on 'human-in-the-loop' operational discipline rather than technical enforcement.
What to consider before installing
What to consider before installing:
- Code review: Inspect the Python scripts (order_sign.py, order_make_sign_send.py, bitget_agent_api.py, x402_pay.py) yourself or have a trusted engineer review them for logging of secrets, hardcoded endpoints, or unexpected network requests. Don’t assume the SKILL.md statements about not logging mnemonics are enforced in code.
- Protect keys: Treat the BIP-39 mnemonic/private keys as highly sensitive. Prefer using an external/hardware signer or a dedicated secret store that the agent cannot directly print or leak. Avoid passing raw private keys on CLI flags on multi-tenant or untrusted hosts.
- Disable auto-update: The skill’s suggested behavior to re-install/replace local files from GitHub is convenient but risky. If you allow updates, restrict them to a vetted process (signed releases, CI-verified artifacts, or manual pull & review) rather than allowing the agent to overwrite code automatically.
- Principle of least privilege: Only give this skill the minimum runtime permissions needed (network access to the documented API endpoints and read access to the secure storage holding keys). Do not run it with global filesystem or admin rights.
- Human confirmation & auditing: Enforce an out-of-band confirmation step for any fund-moving action and keep an audit trail (what command ran, which orderId, which address, which key was used). Configure the agent so that signing cannot happen without an explicit user-confirmed CLI action.
- Test in sandbox: Before connecting real funds, test the skill in a sandbox with watch-only addresses or testnet tokens to observe network behavior and confirm no unexpected endpoints are contacted (especially for x402 flows that may contact arbitrary facilitators).
If you lack the ability to verify the scripts or enforce these controls, treat this skill as higher-risk and avoid providing real wallet keys or permitting autonomous signing.Like a lobster shell, security has layers — review code before you run it.
latestvk97epvx2ams53zzxz7kyayd77583gqg1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.