MistTrack Skills

Cryptocurrency address risk analysis, AML compliance checks, and on-chain transaction tracing using the MistTrack OpenAPI. MistTrack is an anti-money launder...

This skill is coherent with its described purpose, but take these precautions before installing or enabling it in an agent pipeline: - Verify source: registry metadata in the package header claims unknown source/homepage while embedded metadata/README reference a GitHub repo — confirm the canonical repository (and review it) before trusting the package. - Prefer using MISTTRACK_API_KEY (read-only) for routine checks. Do not provide private keys unless you intentionally need on-chain signing. - If you must use x402 payments: store the private key in a file with strict permissions (chmod 600) and pass it only via --key-file when running pay.py; avoid placing private keys in environment variables or command-line args. The package already refuses X402_PRIVATE_KEY env var and enforces a $1 USDC hard cap per call, but these mitigations do not eliminate risk if the agent autonomously calls pay.py with a key file. - On agent platforms: ensure the payment sub-skill is not invoked autonomously (platforms that honor disable_model_calls can block it; others may not). Never enable automated "--auto" payment flows in production. - Audit the scripts before running in production (they perform network calls to https://openapi.misttrack.io and signing operations). Run them in an isolated/test account first to validate behavior and rate limits. If you want, I can: (1) point out exactly where pay.py enforces the $1 cap and where it checks/refuses an env var, (2) search the code for any other network endpoints, or (3) produce a minimal checklist you can follow when enabling this skill in an automated wallet pipeline.

Type: OpenClaw Skill Name: misttrack-aml-skills Version: 0.2.12 This skill bundle provides a comprehensive toolkit for cryptocurrency AML analysis and transaction tracing via the MistTrack API. It includes scripts for risk scoring, address investigation, and multisig analysis across multiple blockchains (BTC, ETH, TRX, etc.). While `scripts/pay.py` enables on-chain USDC payments using the x402 protocol, it implements robust security controls, including a hard-coded $1.00 USDC per-call cap and a strict requirement for file-based private key input (explicitly refusing environment variables to prevent accidental exposure). The documentation (SKILL.md, skills/payment.md) clearly flags these high-risk capabilities and includes a `disable_model_calls` directive to prevent unauthorized autonomous execution by agents. No evidence of malicious intent, data exfiltration, or obfuscation was found.