59/100 (Medium)

OpenClaw： suspicious
VirusTotal： benign
StaticScan： unknown

OpenClaw： suspicious

The skill's purpose (execute restricted DeFi trades) matches requiring an operator private key, but the SKILL.md and README ask for plaintext operator keys in agent config files and instruct the agent...

[内容已截断]

VirusTotal： benign VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1772833741446,
        "_id": "k975gj3gpec7fzck4qqe3tb3t982dmm0",
        "changelog": "Add on-chain enforcement evidence to policy rejection output; enhance SKILL.md with product overview, security architecture diagram, and 4-policy stack documentation",
        "changelogSource": "user",
        "createdAt": 1772833741446,
        "parsed": {
            "clawdis": {
                "author": "SHLL Team",
                "envVars": [
                    {
                        "description": "Operator wallet private key (AI-only hot wallet). MUST be a dedicated wallet with minimal BNB for gas only. NEVER use your main wallet, owner wallet, or any wallet holding significant funds. Even if this key leaks, on-chain PolicyGuard limits actions to policy-approved trades.",
                        "name": "RUNNER_PRIVATE_KEY",
                        "required": true
                    },
                    {
                        "description": "Optional BSC RPC URL override. A private RPC is recommended for reliability.",
                        "name": "SHLL_RPC",
                        "required": false
                    }
                ]
            }
        },
        "version": "6.0.4"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "kledx",
        "handle": "kledx",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/259126602?v=4",
        "kind": "user",
        "linkedUserId": "kn76mmcdkay5p51965v54gtngd8239nc"
    },
    "ownerHandle": "kledx",
    "skill": {
        "_creationTime": 1772833741446,
        "_id": "kd7332wt9fhejm2mjxhrcsrfdx82dn0p",
        "badges": [],
        "createdAt": 1772833741446,
        "displayName": "SHLL Safe Execution",
        "latestVersionId": "k975gj3gpec7fzck4qqe3tb3t982dmm0",
        "ownerUserId": "kn76mmcdkay5p51965v54gtngd8239nc",
        "slug": "shll-run",
        "stats": {
            "comments": 0,
            "downloads": 164,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 1
        },
        "summary": "Execute DeFi transactions on BSC via SHLL AgentNFA. The AI handles all commands and users only need to chat.",
        "tags": {
            "latest": "k975gj3gpec7fzck4qqe3tb3t982dmm0"
        },
        "updatedAt": 1772833821131
    }
}