Near Name Service

Manage NEAR Name Service (.near domains) - check availability, register, resolve, and manage names.

What to consider before installing: - Functionality: The skill actually implements NEAR RPC calls and runs the NEAR CLI (via shell exec), which fits its stated purpose. - Missing declarations: The registry metadata does not list required binaries, but you need Node.js and the NEAR CLI installed and configured locally. Expect it to use your NEAR CLI keys/signers when performing registrations. - Review & test: Inspect the included script (scripts/nameservice.js) yourself (it’s short) and test on testnet first. The code defaults to testnet (isTestnet = true) — that’s safer for initial testing. - Potential bug: The register command builds the contract call argument as '{"account_id":"<fullName>"}', which appears to set the name itself as the account_id rather than the target account; this looks like a logic bug and could cause unintended behavior during registration. Ask the author to clarify or fix before using on mainnet. - Trust & keys: Because the script calls your NEAR CLI, it will use whatever keys your NEAR CLI has access to. Only run it if you trust the skill author and you understand which account will be charged for registration. - If you want lower risk: require the author to update metadata to declare Node/NEAR CLI requirements, provide an install spec or explicit instructions, and fix the registration argument logic. After that, the package would be closer to 'benign'.

Type: OpenClaw Skill Name: near-name-service Version: 1.0.0 The skill is classified as suspicious due to a critical shell injection vulnerability in `scripts/nameservice.js`. The `registerName` function directly interpolates user-provided `name` and `accountId` (from `process.argv` or `process.env.NEAR_ACCOUNT`) into a `child_process.exec` command without proper sanitization. This allows an attacker to execute arbitrary commands on the host system by crafting malicious input for the `name` or `accountId` parameters, despite the skill's stated purpose being benign.