Sharkflow

⚡ SharkFlow - 链上任务自动化，智能合约交互队列 + 多签工作流

This package promises full on‑chain automation (task queue, multisig, execution) but the actual code is a placeholder and a local template manager — it's internally inconsistent. Before running or installing: (1) don't paste private keys or seed phrases into any config files; use hardware wallets or external signing services if you intend to use on‑chain features; (2) inspect the actual scripts you will run (scripts/flow.mjs and scripts/template.mjs) — here flow.mjs is a harmless stub but the SKILL.md is misleading; (3) run the code in a sandboxed environment (container or VM) rather than your main machine; (4) verify the package source (the package.json points to a GitHub repo) and contact the author or check the repository history to confirm whether the promised features are implemented; (5) be cautious with 'npx' installs from unknown authors — they execute remote code. If you need real DeFi automation, prefer packages with implemented code, clear audit history, and minimal privilege requirements.

Type: OpenClaw Skill Name: sharkflow Version: 0.2.0 The skill bundle appears to be a placeholder for a DeFi automation tool, but the provided code in 'scripts/flow.mjs' is non-functional, merely printing a 'Project under development' message. Crucially, the 'SKILL.md' instructions direct the AI agent to install the tool via 'npx @gztanht/sharkflow', which fetches and executes code from a remote registry (npm) that is not part of the analyzed files. This discrepancy between the benign placeholder code and the instruction to execute unvetted remote artifacts is a significant security risk and a common indicator of a supply chain attack or a multi-stage payload delivery.