Monitors large cryptocurrency wallet balances (whales) on-chain using Web3 RPC to detect potential market-moving activity. Can read from `references/wallets....

This skill is coherent with its stated purpose, but review these practical points before running: - Inspect the script (scripts/monitor.js) yourself — it only reads references/wallets.md or CLI args and posts JSON-RPC requests to the configured RPC_URL (default: https://eth.llamarpc.com). - RPC_URL is optional but can be set; avoid pointing it at unknown or untrusted endpoints if you care about exposing which addresses you query. - No credentials are requested; the tool only prints balances to stdout. If you schedule it (cron), consider where logs go (avoid sending outputs to public locations). - Ensure you run it with a recent Node version (Node 18+ provides global fetch) or run with a fetch polyfill. - For extra caution, run it in an isolated environment with restricted network egress if you want to limit outbound connections.

Type: OpenClaw Skill Name: crypto-whale-monitor Version: 1.0.3 The skill's code (`scripts/monitor.js`) is benign, performing its stated function of monitoring cryptocurrency wallets using public RPCs without any malicious actions or vulnerabilities. However, the `SKILL.md` file contains a direct instruction to the AI agent: 'Set up a cron job to run `npm start` periodically for automated monitoring.' While the stated objective of automated monitoring is aligned with the skill's purpose, this instruction represents a prompt injection risk, as it directs the agent to modify system persistence (cron job). This capability, even with a benign stated intent, is a high-risk behavior for an AI agent and could be abused if the agent is overly permissive or the instruction were subtly altered.