Wallet Twin Court

Use this skill when the user wants to put a Solana wallet on trial, identify the action most likely to cause regret tomorrow, return a verdict, and only then...

This skill is coherent with its stated goal of producing a pre‑trade verdict for a Solana wallet, but it sends the wallet address to a third‑party endpoint you may not control. Before installing or invoking it, confirm: (1) Who operates https://todays-orders.vercel.app and what is their privacy/data retention policy? (2) Does your platform already provide the 'OKX OnchainOS' connector the skill expects, and will any signing/broadcast require your explicit confirmation? (3) Test the skill with an empty/throwaway wallet address first. If you plan to use a real wallet, never allow the skill to perform broadcasts unless you explicitly approve the exact signed transaction; prefer preparing previews locally and signing in your own wallet interface. If you cannot verify the court endpoint operator or you are concerned about exposing wallet addresses, do not use this skill with production funds.

Type: OpenClaw Skill Name: wallet-twin-court Version: 1.0.1 The skill is classified as suspicious due to a potential shell injection vulnerability in the SKILL.md file. The instructions direct the AI agent to construct a shell command using a user-provided wallet address without explicit sanitization, which could allow for arbitrary command execution if a malicious address (e.g., containing backticks or subshells) is provided. Additionally, the skill transmits wallet addresses to an external third-party endpoint (https://todays-orders.vercel.app/api/todays-orders), which, while aligned with the stated purpose of providing a 'wallet court' analysis, constitutes data exfiltration of user-identifiable blockchain information.