Millionfinney Homepage

Learn how to claim pixels on MillionFinneyHomepage, a 1000x1000 on-chain pixel grid. This guide covers art generation, IPFS uploading, and the Founding Bot A...

This skill appears to be a legitimate educational guide for claiming pixels, but be cautious: it includes a runnable Python script and examples that assume you will supply an RPC URL and a PRIVATE_KEY to perform on-chain actions. Before using or running anything: (1) verify the contract address on-chain and confirm the official project domain (millionfinneyhomepage.com) from independent sources; (2) never paste your private key into a skill or chat — use a hardware wallet or a temporary testnet key when experimenting; (3) prefer testing on a public testnet (Sepolia/Goerli) before mainnet; (4) inspect the IPFS upload API and privacy policy for the project if you plan to use their upload endpoint (uploads can tie your wallet to media and may be stored on their backend); (5) review scripts locally (the included Python script only performs offline image processing) and run them offline before handing any credentials to tooling; (6) if you want the skill to perform transactions, require explicit declaration of needed env vars and limit autonomous invocation. If you are unsure about any of the on-chain or API steps, ask for clarification or assistance from a knowledgeable human before proceeding.

Type: OpenClaw Skill Name: millionfinney-homepage Version: 1.2.0 The skill bundle is classified as suspicious due to a potential path traversal vulnerability in `scripts/image_to_pixels.py`. The script takes `--json` and `--csv` file paths as arguments, which, if controlled by a malicious prompt injection, could allow an AI agent to write to arbitrary file locations (e.g., `../../../../etc/passwd`). While the script's core functionality is benign (converting images to pixel data), this lack of input sanitization for file paths presents a vulnerability. There is no evidence of intentional malicious behavior like data exfiltration, backdoors, or unauthorized network activity.