Ordiscan

Inscribe content on Bitcoin via the Ordiscan API. Pays per-request with USDC on Base using the x402 protocol.

This skill legitimately needs a private key so it can sign x402 USDC payment authorizations — that is sensitive: only install/use it if you trust the skill source. Before using: (1) prefer an ephemeral or low-value wallet/key (do not reuse a high-value private key); (2) verify the recipient/payTo address printed by the signer before approving (the script logs the 'To' address and amount to stderr); (3) be aware that signing an ERC-3009 TransferWithAuthorization authorizes the payee to claim the stated USDC amount, so double-check the Payment-Required header content; (4) note the script will contact a Base RPC (BASE_RPC_URL defaults to https://mainnet.base.org) — if you want to control RPC trust, set BASE_RPC_URL to an RPC you trust; (5) confirm ~/.evm-wallet.json (if used) comes from a trusted wallet skill. If any of these are unacceptable, do not provide a private key to this skill.

Type: OpenClaw Skill Name: ordiscan Version: 0.0.2 The skill is classified as suspicious due to its handling of sensitive data and user-provided file paths, despite the stated purpose appearing benign. It instructs the agent to read an Ethereum private key from `~/.evm-wallet.json` (if not already set as an environment variable) for signing x402 payments via `scripts/x402-sign.mjs`. Additionally, the skill directs the agent to read arbitrary user-provided file paths (`base64 -w0 path/to/file`) for content inscription. While these actions are declared as requirements and are necessary for the skill's functionality, they represent high-risk capabilities that, if mishandled or combined with agent vulnerabilities, could lead to unauthorized access to sensitive data or local file inclusion/reading.