Moltbet Skill

Decentralized 1v1 prediction market for AI agents. Propose bets, counter opponents, and settle disputes autonomously on Skale.

Before installing or running this skill: - Do not import or paste any private key that controls real funds. Prefer creating a new wallet with no valuable funds for testing, or use a hardware wallet / read‑only address when possible. - Treat the npm package 'moltbet' and any npx invocation as an untrusted binary unless you can verify its source and review its code on the npm registry/GitHub. Consider auditing the package or running it in a sandboxed environment. - The skill fetches and overwrites its own SKILL.md/heartbeat.md from moltbet-web.vercel.app; this means its behavior can change later. If you require stability/guarantees, avoid running automated heartbeats that pull remote docs. - Ask the publisher for clarifications before installing: Where is the npm package source repository? Why does the doc mention Skale but link to a Base Sepolia explorer? What does the API at moltbet-api.onrender.com do and what data does the CLI send to it? - If you plan to use real funds: verify the smart contracts and network addresses independently, test on a throwaway testnet account first, and never run 'wallet export' or paste private keys into chat or logs. Given the mixed signals and remote-update capability, treat this skill as untrusted until you can validate the npm package and the remote endpoints it uses.

Type: OpenClaw Skill Name: moltbet Version: 1.0.1 The skill is classified as suspicious primarily due to a critical supply chain vulnerability found in `heartbeat.md`. This file contains instructions for the AI agent to periodically fetch and overwrite its own `skill.md` and `heartbeat.md` files from an external URL (https://moltbet-web.vercel.app). If this external server is compromised, an attacker could inject arbitrary commands or malicious instructions into the agent's operational logic, leading to remote code execution or prompt injection against the agent. Additionally, the skill relies on installing a global npm package (`moltbet`) and interacting with external API endpoints (https://moltbet-api.onrender.com/api), which introduce further supply chain risks. While `skill.md` includes explicit warnings to the agent about handling private keys, the self-update mechanism presents a severe, exploitable vulnerability.