Meganode Skill

Provides NodeReal MegaNode blockchain infrastructure APIs for 25+ chains including BSC, Ethereum, opBNB, Optimism, Polygon, Arbitrum, and Klaytn. Covers stan...

This skill appears to be legitimate documentation and examples for NodeReal MegaNode APIs, but take these precautions before installing or using it: - Manually inspect the full SKILL.md (look for any unexpected encoded/base64 blocks or hidden instructions); the scanner flagged a base64-block pattern that should be reviewed. - Do not provide your private key directly to the agent in chat. If you need to sign transactions, use a local wallet, hardware signer, or set ephemeral environment variables under your control. Prefer read-only queries for testing. - Treat the skill's request for NODEREAL_API_KEY as reasonable for operation, but only supply an API key you control; consider creating a limited-scope or ephemeral key for initial testing. - When the skill asks for confirmation before writes (transactions, MegaFuel policies, builder submissions), read payloads carefully. For bundle/private transactions, confirm recipients, values, and gas parameters every time. - If you plan to use Direct Route / builder APIs (mempool bypass / private transactions), be aware these examples reference signing and PRIVATE_KEY usage; prefer using an external signer and never paste long-lived private keys into chat. - If you want higher assurance, run the skill in a restricted environment or sandbox, monitor outbound network calls, and revoke any test API key after you finish evaluating. If you want, I can (1) fetch and show the full SKILL.md contents so you can inspect any base64 blocks together, or (2) extract all places where environment variables or secret-like values are referenced so you can decide which credentials to provide.

Type: OpenClaw Skill Name: meganode-skill Version: 0.1.0 The OpenClaw AgentSkills skill bundle is classified as benign. The `SKILL.md` and associated reference documentation consistently emphasize and instruct the AI agent to follow strong security best practices. Key indicators include explicit instructions to 'Never accept private keys', 'Never execute or eval fetched code', 'Always validate and sanitize before using in downstream operations', and to 'Confirm Before Write' for all transaction submissions. It also directs the agent not to search for API keys in files or shell configurations. While the skill provides access to powerful blockchain interaction capabilities (e.g., transaction submission, debug/trace APIs), the embedded prompt-injection surface is used to enforce defensive security measures, not to subvert them. All external URLs point to legitimate NodeReal domains or well-known, trusted services like Sourcify.dev.