中文 EN
Start Review
Skill Trust Decision

whale-scanner

该技能为加密货币支付收割工具，代码本身仅含网络请求，但域名含"money-machine"且 SKILL.md 中嵌入了被混淆的 SOL 支付指令。

Install decision first Source: ClawHub Scanned: Jun 5, 2026
Files 4
Artifacts 4
Violations 0
Findings 3

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

4 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

What drove the risk score up

SKILL.md 混淆文字 +20

SKILL.md 包含被破坏的混淆文本（"Calls are free for basic health"），疑似通过文本混淆规避平台审核

可疑域名 +15

API 目标域名 money-machine-x402-ssyopros.zocomputer.io 含 'money-machine'，暗示货币收割意图

硬编码加密货币地址 +10

代码中硬编码 Solana 地址 AKz1pZ8yxtFQLwTpDKJGZjLeBUX4rnobX7HdMF3uvK6W 用于收款

Most important evidence

Medium Doc Mismatch

SKILL.md 包含混淆文本

SKILL.md 混合了破碎的可读文本 'Calls are free for basic health, but premium signals require a 402 payment proof'，疑似通过插入无意义文本规避平台内容审核机制。

SKILL.md:9
移除混淆文字，使用清晰的描述说明 402 支付机制。
Medium Supply Chain

API 目标域名含货币收割语义

目标 API 域名 'money-machine-x402-ssyopros.zocomputer.io' 包含 'money-machine' 字样，暗示该服务的主要目的可能是货币收割而非纯粹的技术监控。

index.js:3
使用可信的金融数据 API 服务（如 CoinGecko、Alpha Vantage）替代自托管域名。
Low Doc Mismatch

硬编码 Solana 收款地址

代码对 402 响应返回硬编码的 Solana 地址 'AKz1pZ8yxtFQLwTpDKJGZjLeBUX4rnobX7HdMF3uvK6W'，该地址未在 SKILL.md 中声明。

index.js:8
在 SKILL.md 中明确声明支付机制，并将支付地址替换为标准支付接口。

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred NONE
无文件系统操作
Network Pass
Declared READ
→
Inferred READ
index.js:3 仅发起 fetch 请求读取外部 API
Shell Pass
Declared NONE
→
Inferred NONE
无 shell 调用
Environment Pass
Declared NONE
→
Inferred NONE
无环境变量访问
Skill Invoke Pass
Declared NONE
→
Inferred NONE
无跨技能调用

Suspicious artifacts and egress

Medium External URL
https://money-machine-x402-ssyopros.zocomputer.io/api/whale/$

index.js:3

Medium External URL
https://ssyopros.zo.space/pricing

index.js:9

Medium External URL
https://clawhub.ai/user/ssidharhubble

skill-card.md:7

Medium External URL
https://clawhub.ai/ssidharhubble/whale-scanner

skill-card.md:27

Dependencies and supply chain

There are no structured dependency warnings.

File composition

4 files · 88 lines
Markdown 2 files · 58 linesJavaScript 1 files · 22 linesJSON 1 files · 8 lines
Files of concern · 3
skill-card.md Markdown · 40 lines
https://clawhub.ai/user/ssidharhubble · https://clawhub.ai/ssidharhubble/whale-scanner
index.js JavaScript · 22 lines
API 目标域名含货币收割语义 · 硬编码 Solana 收款地址 · https://money-machine-x402-ssyopros.zocomputer.io/api/whale/$ · https://ssyopros.zo.space/pricing
SKILL.md Markdown · 18 lines
SKILL.md 包含混淆文本
Other files · package.json

Security positives

代码量极小（仅 22 行），无复杂恶意逻辑
无文件系统访问，无凭证收割
无 shell 命令执行，无 RCE 风险
package.json 无第三方依赖，无供应链风险
代码功能与声称的监控用途基本一致