Garden Temp Market (GTM)

Participate in Base's GTM by betting if today's 18:00 UTC garden temperature will be higher or lower than yesterday's, sharing winnings from the pot.

This skill appears to be a straightforward helper for a Base-based temperature prediction market. Before installing or using it: (1) do not paste your private key into untrusted places — the instructions require a signing key to send bets (cast/Bankr), so use a secure wallet or signing service; (2) verify the contract addresses and keeper/trust model yourself — the README warns the keeper submits settlement values off-chain; (3) the bundle contains Foundry/forge-std helper files (including a script that fetches cheatcodes from GitHub if you run it) — only run included scripts if you trust their behavior and source; (4) avoid reusing sensitive credentials (PRIVATE_KEY, BASESCAN_API_KEY) unless you control them and understand the transaction consequences. If you want additional assurance, ask the skill author for a canonical homepage/repo or an audit of the contract and keeper workflow.

Type: OpenClaw Skill Name: prediction-market Version: 1.0.1 The skill bundle is classified as suspicious due to the presence of shell commands in `SKILL.md` that directly handle sensitive data (private keys) via the `--private-key $KEY` argument for `cast send`. While this is a common pattern for CLI tools and is plausibly needed for blockchain interaction, it represents a significant vulnerability surface if the AI agent's execution environment or prompt handling is not robust against shell injection or insecure credential management. Additionally, the `lib/forge-std/foundry.toml` file contains broad filesystem write permissions (`fs_permissions = [{ access = "read-write", path = "./" }]`) which, although intended for development/testing, could be exploited if the agent were to execute arbitrary `forge` commands. There is no clear evidence of intentional malicious behavior, but these risky capabilities warrant a 'suspicious' classification.