Multicall

Analyze multicall operations. Use when you need to understand multicall mechanisms, evaluate protocol security, or reference on-chain concepts.

This skill is a simple local CLI implemented as a Bash script that stores its data in a user directory (default ~/.multicall). It does not contact external endpoints or request credentials. Before installing or running: (1) inspect the script yourself (it is included) to confirm you are comfortable with it creating/modifying files under the data directory; (2) avoid adding secrets to entries stored by the tool; (3) if you prefer, set MULTICALL_DIR to a controlled location; (4) note that the agent can invoke the skill when asked — the skill will then read/write the configured data files. If any of those behaviors are unacceptable, do not install or run the skill.

Type: OpenClaw Skill Name: multicall Version: 1.0.0 The 'multicall' skill (scripts/script.sh) is a generic data-logging tool that lacks the blockchain analysis functionality described in its documentation (SKILL.md). It contains several input sanitization vulnerabilities, specifically a 'sed' injection risk in the 'cmd_config' function and unescaped JSON construction in 'cmd_add', which could lead to local data corruption or unexpected behavior. While no evidence of intentional malice, data exfiltration, or remote execution was found, the discrepancy between its stated purpose and actual implementation, combined with these vulnerabilities, warrants a suspicious classification.