55/100 (Medium)

OpenClaw： suspicious
VirusTotal： benign
StaticScan： suspicious

OpenClaw： suspicious

The skill's actions and files are consistent with an on‑chain trading tool, but there are notable mismatches and sensitive capabilities (local wallet files, seed export, npm install, and a curl|bash F...

[内容已截断]

VirusTotal： benign VT 报告

静态扫描： suspicious

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

README 未提供

{
    "latestVersion": {
        "_creationTime": 1774516400693,
        "_id": "k97age8z2dxbqct1bpgvwd5m2n83msst",
        "changelog": "**Summary:**  \nThis release adds delegated intent support, enabling handoff to other trading skills (e.g. prediction markets or perps), and refines environment\/security declarations.\n\n- Adds intent delegation: now routes non-XAUT trading requests (e.g. Polymarket, Hyperliquid) to registered skills\n- New documentation on skill delegation in `references\/skill-delegation.md`\n- Expands and revises intent triggers (perps, prediction markets, etc.) in documentation and manifest\n- Updates security\/env declarations for clarity; improves environment readiness workflow\n- Minor README and internal script improvements for maintainability",
        "changelogSource": "auto",
        "createdAt": 1774516400693,
        "version": "2.2.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "s171zxp6gfdn6n628g3vz83vc183nhyk",
        "displayName": "aure-duncan",
        "handle": "aure-duncan",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/118319804?v=4",
        "kind": "user",
        "linkedUserId": "kn7ec0bbtyhs5pvra3g6vqqhd182dsk2"
    },
    "ownerHandle": "aure-duncan",
    "skill": {
        "_creationTime": 1772759808731,
        "_id": "kd791mh7hea4vzesrpghqnehy182cgc9",
        "badges": [],
        "createdAt": 1772759808731,
        "displayName": "xaut-trade",
        "latestVersionId": "k97age8z2dxbqct1bpgvwd5m2n83msst",
        "ownerPublisherId": "s171zxp6gfdn6n628g3vz83vc183nhyk",
        "ownerUserId": "kn7ec0bbtyhs5pvra3g6vqqhd182dsk2",
        "slug": "aurehub-xaut-trade",
        "stats": {
            "comments": 0,
            "downloads": 288,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 1,
            "versions": 6
        },
        "summary": "Buy or sell XAUT (Tether Gold) on Ethereum. Supports market orders (Uniswap V3) and limit orders (UniswapX). Wallet modes: Foundry keystore or WDK. Delegates...",
        "tags": {
            "latest": "k97age8z2dxbqct1bpgvwd5m2n83msst"
        },
        "updatedAt": 1774762298852
    }
}