90/100 (Very Low)

OpenClaw： benign
VirusTotal： benign
StaticScan： suspicious

OpenClaw： benign

The skill's code, install spec, and runtime instructions are consistent with its described purpose (interacting with Rhaios staging API and signing transactions via Privy or a local private key).

VirusTotal： benign VT 报告

静态扫描： suspicious

Detected: suspicious.env_credential_access

README 未提供

{
    "latestVersion": {
        "_creationTime": 1773603899492,
        "_id": "k97dhjfrgpyznhwgdt9062ydq182y9qc",
        "changelog": "Remove undeclared env reads (CHAIN_RPC_URL, X402_PAYMENT_HEADER) — staging uses managed forks and x402 is disabled",
        "changelogSource": "user",
        "createdAt": 1773603899492,
        "parsed": {
            "clawdis": {
                "envVars": [
                    {
                        "description": "privy or private-key. Defaults to privy.",
                        "name": "SIGNER_BACKEND",
                        "required": false
                    },
                    {
                        "description": "Required only when SIGNER_BACKEND=private-key. 0x-prefixed 32-byte hex.",
                        "name": "SIGNER_PRIVATE_KEY",
                        "required": false
                    },
                    {
                        "description": "Provided by Privy skill. Required when SIGNER_BACKEND=privy.",
                        "name": "PRIVY_APP_ID",
                        "required": false
                    },
                    {
                        "description": "Provided by Privy skill. Required when SIGNER_BACKEND=privy.",
                        "name": "PRIVY_APP_SECRET",
                        "required": false
                    },
                    {
                        "description": "Required when SIGNER_BACKEND=privy. Must be ownerless.",
                        "name": "PRIVY_WALLET_ID",
                        "required": false
                    },
                    {
                        "description": "Required when SIGNER_BACKEND=privy. 0x-prefixed address.",
                        "name": "PRIVY_WALLET_ADDRESS",
                        "required": false
                    }
                ],
                "install": [
                    {
                        "kind": "node",
                        "package": "@rhaios\/toolkit"
                    }
                ],
                "primaryEnv": "PRIVY_WALLET_ADDRESS"
            }
        },
        "version": "0.1.4"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "João",
        "handle": "0xtimepunk",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/45543880?v=4",
        "kind": "user",
        "linkedUserId": "kn7bgvgdpn70kekvf1dabtj7tx82yqe9"
    },
    "ownerHandle": "0xtimepunk",
    "skill": {
        "_creationTime": 1773575196792,
        "_id": "kd7ftkdyvbpbrdqpv853w5wmex82yrj4",
        "badges": [],
        "createdAt": 1773575196792,
        "displayName": "Rhaios Staging",
        "latestVersionId": "k97dhjfrgpyznhwgdt9062ydq182y9qc",
        "ownerUserId": "kn7bgvgdpn70kekvf1dabtj7tx82yqe9",
        "slug": "rhaios-staging",
        "stats": {
            "comments": 0,
            "downloads": 132,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 5
        },
        "summary": "Interact with the Rhaios staging REST API for yield operations. Discover -> prepare -> setup-if-needed -> sign -> execute flow with pluggable signer backend....",
        "tags": {
            "latest": "k97dhjfrgpyznhwgdt9062ydq182y9qc"
        },
        "updatedAt": 1773604307517
    }
}