Skill Trust Decision
agentwalletapi
弃用占位符技能声称需要API密钥和curl工具但无任何可执行代码，存在文档欺骗风险
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
声明环境变量但无代码 +15
SKILL.md声明需要AGENTWALLETAPI_KEY但无任何脚本使用它
声明curl依赖但无脚本 +10
声明required_binaries包含curl但整个技能只有2个markdown文件
弃用技能引用外部URL +10
指向clawhub.ai外部链接进行重定向
无实际可执行代码 +10
Skill声称需要环境变量和二进制工具但无任何脚本实现
Most important evidence
Medium Doc Mismatch
环境变量声明与技能功能不符
SKILL.md声明需要AGENTWALLETAPI_KEY环境变量但技能本身仅为重定向文档，无任何脚本需要此凭证
SKILL.md:9 移除不必要的环境变量声明，或明确说明其用途（如供目标skill使用）
Medium Doc Mismatch
依赖声明与实际不符
声明需要curl和jq作为required_binaries/optional_binaries，但整个技能只有markdown文档，无任何可执行脚本
SKILL.md:13 移除不必要的二进制依赖声明
Low Supply Chain
重定向到外部未审核资源
技能引导用户安装来自clawhub.ai的替换技能，替换目标未经过当前技能审核
SKILL.md:19 建议用户在安装前审核替换技能的完整内容和权限声明
Declared capability vs actual capability
Filesystem Pass
Declared NONE
→ Inferred NONE
SKILL.md:1 - 无脚本文件 Network Pass
Declared NONE
→ Inferred NONE
SKILL.md:1 - 声称需要curl但无实际网络代码 Shell Pass
Declared NONE
→ Inferred NONE
SKILL.md:1 - 无任何脚本 Environment Pass
Declared READ
→ Inferred UNKNOWN
SKILL.md声明AGENTWALLETAPI_KEY为必需环境变量但无代码使用 Suspicious artifacts and egress
Medium External URL
https://clawhub.ai/macd2/open-claw-cash SKILL.md:5
Medium External URL
https://clawhub.ai/user/macd2 skill-card.md:9
Medium External URL
https://clawhub.ai/macd2/skills/agent-crypto-wallet-depricated skill-card.md:35
Dependencies and supply chain
There are no structured dependency warnings.
File composition
2 files · 81 lines
Markdown 2 files · 81 lines
Files of concern · 2
skill-card.md https://clawhub.ai/user/macd2 · https://clawhub.ai/macd2/skills/agent-crypto-wallet-depricated
SKILL.md 环境变量声明与技能功能不符 · 依赖声明与实际不符 · 重定向到外部未审核资源 · https://clawhub.ai/macd2/open-claw-cash
Security positives
无任何可执行代码，无法直接造成危害
文档明确标注为弃用并提供重定向
声称version 1.9.1与skill-card声明的1.9.9不一致，已标记为过时