Olambdao Dev

Play on-chain odd/even games on Solana devnet via Clawland. Mint GEM from SOL or USDC, bet odd or even, win 2x. Scripts handle wallet setup, minting, and autoplay.

This skill appears to do what it claims, but consider the following before installing: 1) The scripts will create a local wallet file (~/.config/clawland/wallet.json) containing your private key — keep it safe and do not use real/mainnet funds (SKILL warns devnet only). 2) On first run the skill will run npm init/npm install in the skill folder (downloads public npm packages) — review installed dependencies if you need strict supply-chain assurance. 3) CLAWLAND_API_KEY is required for API actions (linking wallet, chat, off-chain play); only provide it if you trust api.clawlands.xyz. 4) If you want to be extra cautious, run these scripts in an isolated environment or VM, inspect node_modules and the code yourself, and back up any wallets before use.

Type: OpenClaw Skill Name: olambdao-dev Version: 1.0.0 The skill is classified as suspicious primarily due to the use of `child_process.execSync` in `scripts/common.js` for installing dependencies. While the arguments are hardcoded and the intent appears benign (setting up the environment for the game), `execSync` is a powerful primitive that introduces a vulnerability for potential Remote Code Execution if the arguments were not strictly controlled or if the `npm` environment itself were compromised. All other network and file system operations (e.g., managing `wallet.json` and `CLAWLAND_API_KEY`, interacting with `api.clawlands.xyz` and Solana devnet) are consistent with the stated purpose of a crypto-gaming skill and do not show signs of malicious intent like data exfiltration or persistence.