Mint Club V2

Command-line interface for creating, trading, and managing Mint Club bonding curve tokens on Base blockchain with wallet support and Uniswap integration.

This skill delegates work to an external npm CLI that will ask for or store your wallet private key and can execute on‑chain trades and token approvals. The registry metadata does not declare the PRIVATE_KEY or config paths that the instructions use — an inconsistency you should treat as a red flag. Before installing or invoking this skill: 1) inspect the npm package source (github link) for malicious or confusing code; 2) never provide a real private key—use a watch-only address or an ephemeral/test wallet with minimal funds; 3) review the package's npm page and maintainers, and prefer pinned, verified releases; 4) be aware the CLI will write files under ~/.mintclub (tokens.json, .env) which may contain sensitive data; 5) if you allow the agent to run it, consider disallowing autonomous invocation or restrict the agent to read-only operations. Additional information that would raise confidence to 'benign': the skill metadata declaring required env/config paths, an included verified source link to the CLI repository, and an audited package release.

Type: OpenClaw Skill Name: mintclub Version: 1.0.0 This skill bundle is classified as suspicious due to its inherent high-risk capabilities, specifically the explicit handling of private keys and the ability to initiate financial transactions (buying, selling, swapping, and sending cryptocurrency) on the Base network. The `SKILL.md` and `README.md` files clearly instruct the agent on how to set a private key (e.g., `mc wallet --set-private-key 0x...` or `export PRIVATE_KEY=0x...`) and execute commands that directly transfer or manage digital assets. While these actions are aligned with the stated purpose of interacting with Mint Club V2, they represent significant financial risk and require a high degree of trust in the underlying `mint.club-cli` and the agent's operational security. There is no evidence of intentional malicious behavior (e.g., exfiltration, backdoor installation, or prompt injection for harmful objectives) within the provided files, but the powerful nature of these operations warrants a 'suspicious' classification.