Web3 Target Team Research

Find crypto/web3 teams with $10M+ funding and verified Telegram contacts. Use when hunting for crypto leads, building contact lists, researching funded startups, or prospecting web3 companies. Spawns parallel subagent hunters to search VC portfolios and verify TG handles.

This skill appears to do what it says (hunt funded Web3 teams and verify Telegram handles), but it contains multiple red flags you should consider before installing: - Hard-coded local paths: The instructions reference /Users/derrick/... CSVs and HEARTBEAT.md. Confirm whether the skill will be run in an isolated workspace or if it will try to read/write files in your home directory. If you don't know why those paths are present, don't install or ask the author to generalize to workspace-relative paths. - Persistent, autonomous behavior: The skill tells the agent to create a cron job and continuously respawn subagents (24/7). If installed, it could run indefinitely and spawn many subagents. Limit installation to manual/invokable-only use or require human approval for spawning jobs. - File access and privacy: The skill instructs using cat/grep on CSVs and updating HEARTBEAT.md — verify what files the agent can access. If your environment grants broad filesystem access, this could expose unrelated data. - Platform capabilities: The instructions assume platform functions like sessions_spawn, sessions_list, cron({...}), and web_fetch screenshots. Confirm whether your environment supports those APIs and what permissions they grant. If those APIs can create persistent jobs or spawn many subagents, consider restricting or monitoring them. - Operational/ToS considerations: The skill scrapes Telegram profiles and takes screenshots. Ensure this behavior aligns with legal/ToS rules for the sites you target. Recommendations: only run this skill in a sandboxed environment, require manual invocation rather than auto-respawn, remove or change hard-coded absolute paths to workspace-relative locations, and require human confirmation before spawning subagents or adding cron jobs. If you need continuous operation, get explicit documentation on how the cron/session APIs behave and what limits you can apply (rate limits, maximum subagents, logging, and stop procedures).

Type: OpenClaw Skill Name: web3-target-team-research Version: 1.0.1 The skill is classified as suspicious due to its aggressive use of agent capabilities and potentially problematic file access instructions. It explicitly sets up a cron job and modifies HEARTBEAT.md for continuous, 24/7 auto-respawning of subagents, which is a form of persistence. It also instructs the agent to use a 'screenshot' capability for Telegram profile verification, a high-risk action. Furthermore, the `references/workflow.md` file contains hardcoded absolute paths (`/Users/derrick/clawd/crypto-master.csv`) for reading and writing data, which, while targeting the skill's own data files, could lead to unintended behavior or write attempts outside the designated workspace if the agent's environment differs from the hardcoded path.