solidity-audit

Solidity smart contract security audit assistant following EEA EthTrust V3 specification. Performs structured audit workflow: vulnerability scanning, securit...

This skill appears coherent and appropriate for performing Solidity audits. Before installing or running its advised commands: 1) review any remote installer scripts (the Foundry curl installer) and prefer official sites/releases; 2) pin and verify tool versions (pip/cargo packages) to avoid unexpected updates; 3) run installations and scans in an isolated environment (container/VM) to limit risk; 4) do not upload private keys, .env files, or unrelated secrets as part of the code to be audited; and 5) inspect the included scripts (scripts/init_audit.py) to confirm they only create local scaffolding (they do). If you want higher assurance, ask the publisher for a signed release or run the toolchain installs manually under your control.

Type: OpenClaw Skill Name: solidity-audit Version: 1.0.1 The bundle provides a professional Solidity audit framework based on EEA EthTrust V3 and Secureum standards. It is classified as suspicious because SKILL.md contains high-risk instructions for the AI agent to execute shell commands, including 'curl | bash' for Foundry installation and various 'pip'/'cargo' installs for security tools. While these capabilities are plausibly required for the stated purpose of performing automated security scans, they grant the agent broad execution power. No evidence of intentional malice, data exfiltration, or obfuscation was found in the Python initialization script (scripts/init_audit.py) or the extensive documentation.