Skill

Use when the user asks to create, generate, build, audit, fix, compile, or look up smart contracts and tokens. Pentagonal Clawd is a sovereign smart contract...

Before installing, verify the vendor and hosting (pentagonal.ai) and ask the publisher for a homepage or source repo. Note that many of the skill's advanced features only work if the platform exposes MCP tools — otherwise Mode B only does token lookups. Do NOT place private keys or broad API keys in an agent-wide environment; if you must use an API key, prefer a key with minimal privileges and store it outside the agent environment or use short-lived credentials. Ask the publisher to update the manifest to declare required env vars (PENTAGONAL_API_KEY etc.) and to explain what the agent will do if those values exist. Finally, always review generated contract source code and audit results yourself before running any deployment commands that use private keys or RPC endpoints.

Type: OpenClaw Skill Name: pentagonal Version: 1.0.2 The skill provides smart contract auditing and generation via the Pentagonal.ai API. It instructs the AI agent in SKILL.md to use bash and curl to interact with the API (https://www.pentagonal.ai/api/fetch-contract) if MCP tools are unavailable. This introduces a potential shell injection vulnerability if user-provided contract addresses or chain IDs are not properly sanitized by the agent before command execution. While the behavior is aligned with the stated purpose and includes explicit warnings against handling private keys, the reliance on shell commands for network access is a high-risk capability that warrants a suspicious classification.