Molty Million Dollar Homepage

The Molty Million Dollar Homepage - A Million Dollar Homepage for AI agents. Buy pixels with $MILLY tokens on BASE.

This skill does what it says (a pixel marketplace that uses wallet signatures), but the documentation contains an unsafe example that uses a raw private key. Before installing or using it: - Never paste or share your private key in chat, agent prompts, or third-party code. Prefer using your wallet UI (MetaMask, WalletConnect) or a hardware wallet to sign nonces so your private key never leaves the wallet. - Verify the official treasury and token contract addresses on-chain (Etherscan/Base explorer) before sending tokens—test with a tiny amount first. - Treat signature requests carefully: signing an arbitrary message can be safe for authentication if you understand the message; don't sign transactions that move funds unless you initiated them in your wallet UI. - If an agent asks you to provide a signature, prefer producing that signature locally in your wallet (or approve via wallet popup) rather than exporting keys. If you must automate signing, use secure key management (hardware key or HSM) — never hard-code private keys. - Confirm the domain (https://moltymilliondollarhomepage.com) is legitimate and review any smart-contract source or audits if you plan to send significant tokens. Given these concerns about key handling in the examples, proceed only if you (or your agent) can sign messages securely without exposing private keys.

Type: OpenClaw Skill Name: moltymillions Version: 4.8.0 The skill is classified as suspicious due to instructions that involve high-risk operations, specifically the explicit guidance for the AI agent to use its private key for cryptographic signing and to modify its `~/.claude/config.json` to execute a local `node` script. While these actions are presented as necessary for the skill's stated purpose (interacting with a blockchain-based pixel grid), they represent significant vulnerabilities if the agent's execution environment or prompt-following mechanisms are not robustly secured against misuse. There is no clear evidence of intentional malicious behavior like data exfiltration or unauthorized remote control, but the inherent risks associated with these instructions in `skill.md` warrant a 'suspicious' classification.