Buy Sovereign Domain (Handshake DNS)

Register sovereign domains (.badass, .forever, .fuck, .rebel, .pump, .hello, .howdy, .robo, .dnet, .f, bear emoji) on Ethereum mainnet via Impervious Domains...

This skill is ambiguous rather than clearly malicious, but proceed cautiously. Before installing or using it, ask the author to: (1) provide the full ABIs and contract addresses used (not a relative `{baseDir}` reference), (2) explicitly describe how transactions are signed (do not share private keys — prefer user-side signing or hardware wallet), and (3) show the exact RPC endpoints and explain any API keys. Never paste your private key or seed phrase into the agent; instead, require the agent to prepare unsigned transactions for you to sign offline or via your wallet. If you must test, use a fresh ephemeral wallet with minimal funds on a testnet first and verify every transaction payload and destination contract address. If the skill asks to read local files outside its bundle or to accept a private key, decline until the above are clarified. If the skill's source or homepage is unknown, prefer not to grant sensitive access (private keys, full-access RPC endpoints) until the code or a trustworthy origin is available.

Type: OpenClaw Skill Name: buy-handshake-domain Version: 1.0.0 The `SKILL.md` file contains an instruction for the AI agent to reference a file outside its bundle using a directory traversal path: `{baseDir}/../../skills.md`. This is a significant prompt injection vulnerability and an attempt to access unauthorized files. An AI agent might interpret 'See the full registration skill spec' as an instruction to read and incorporate content from an arbitrary `skills.md` file located two directories above the skill's base, potentially leading to unintended actions or information disclosure if that file contains sensitive data or malicious instructions.