Safe Multisig Skill

Propose, confirm, and execute Safe multisig transactions using the Safe{Core} SDK (protocol-kit v6 / api-kit v4). TypeScript strict. Use when an agent needs to operate a Safe smart account — (1) create/predict a new Safe, (2) fetch Safe owners/threshold/nonce, (3) list pending multisig txs, (4) build + propose a tx, (5) add confirmations, (6) execute a tx onchain, or (7) troubleshoot Safe nonce/signature issues across chains (Base/Ethereum/Optimism/Arbitrum/Polygon/etc.).

This package appears to implement exactly what it says (a Safe multisig CLI) but it does require sensitive secrets that the registry metadata does not advertise. Before installing or running it: (1) inspect package.json and package-lock (you already have them) and consider running npm install in an isolated environment or container; (2) do NOT provide your main owner private key — use a low-privilege signer, a hardware wallet, or a temporary/test key when experimenting; (3) ensure you set SAFE_SIGNER_PRIVATE_KEY, SAFE_TX_SERVICE_API_KEY (if using the official service), and RPC_URL only in your shell or a secure env-file, not pasted into chat or logs; (4) review the propose-tx script behavior around tx-file paths (it resolves any path — do not point it at files containing other secrets); (5) if you plan to use this for real funds, audit the code or run it in a staging account first; and (6) contact the publisher/source (if you can) to request corrected registry metadata that lists the required env vars.

Type: OpenClaw Skill Name: safe-multisig Version: 2.1.0 The skill is classified as suspicious due to a critical file access vulnerability in `scripts/propose-tx.ts`. Despite a comment indicating an intent to restrict file paths (`// FIX PT-010: Restrict tx-file paths — don't allow absolute paths outside workspace`), the implementation using `path.resolve(process.cwd(), opts.txFile)` allows an absolute path provided to the `--tx-file` option to read arbitrary files on the filesystem (e.g., `/etc/passwd`). If an AI agent is prompted to provide an absolute path to a sensitive file, its content could be read and potentially exfiltrated if it were valid JSON and included in a transaction proposal sent to the Safe Transaction Service. This constitutes a risky capability that could lead to data exfiltration, even without explicit malicious intent from the skill developer.