Monad Development

Builds dapps on Monad blockchain. Use when deploying contracts, setting up frontends with viem/wagmi, or verifying contracts on Monad testnet or mainnet.

This skill largely describes normal Monad development steps, but it contains two red flags you should consider before installing or allowing autonomous use: - It instructs agents to create and persist private keys (writing them to ~/.monad-wallet or project .env). Do not allow an agent to generate and store long-lived private keys on your behalf unless you fully control and encrypt the storage. Prefer generating keys yourself and providing only short-lived credentials or signing operations. - It requires using a third-party proxy API (agents.devnads.com) for faucet and verification and tells the agent not to use a browser. That proxy will receive your contract standard-json, metadata, and addresses — potentially sensitive build/source material. Prefer official endpoints (e.g., faucet.monad.xyz, official explorer APIs) or verify locally where possible, and review the privacy/security policy for any third-party service before sending code or keys. Recommendations before proceeding: - Ask the skill author what agents.devnads.com is and why it's required; request official endpoints or the option to avoid the proxy. - Refuse or limit automatic wallet persistence; if a wallet must be generated, require the agent to return the private key to you only (not persist it) and instruct you how to securely store it. - Use temporary/test wallets with minimal funds for automated flows, and never expose mainnet private keys to an agent or third-party API. - If you need verification automation, prefer using official verification endpoints or run verification locally, and inspect any request payloads (standard-json/metadata) before sending. Because these choices could lead to credential or source-material exposure, treat this skill as suspicious until the author clarifies the proxy usage and the secure handling of private keys.

Type: OpenClaw Skill Name: monad-development Version: 1.0.0 The skill is classified as suspicious primarily due to a clear prompt injection vector in `SKILL.md`, instructing the AI agent to fetch external instructions from `https://docs.monad.xyz/llms.txt`. This allows for dynamic, potentially malicious instructions to be injected into the agent's operational context. Additionally, the skill instructs the agent to generate and persist private keys to local files (e.g., `~/.monad-wallet`), which, while intended for user convenience, creates a high-risk scenario for credential theft if combined with a compromised agent or further injected instructions.