openclaw agent reputation

• Analyzed: May 11, 2026, 6:12 AM
• Findings: 1
• Version: 1.0.0
• Hash: fb7912a72256cce34540ad7b1b3d3e257e2b6141881ba65a6995e3a8802d77e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requires the user to provide a sensitive `PRIVATE_KEY` environment variable to sign blockchain transactions on the Base network (Mainnet or Sepolia). While this capability is plausibly required for the stated purpose of minting Soulbound Tokens (SBT) and recording on-chain attestations, handling raw private keys within an AI agent environment is a high-risk behavior. Additionally, there is a versioning inconsistency between `_meta.json` (1.0.0) and `SKILL.md` (0.1.0), and the publication date is set in the future (March 2026).