Solidity LSP

Solidity language server providing smart contract development support including compilation, linting, security analysis, and code intelligence for .sol files. Use when working with Ethereum smart contracts, Substrate pallets, or any Solidity code that needs compilation, security checks, gas optimization, or code navigation. Essential for ClawChain pallet development.

This skill is not malicious but is inconsistent and has a few risky recommendations. Before installing or following the instructions: (1) Note the mismatch — the skill advertises an LSP but contains only CLI instructions; if you need an LSP, install/verify a real Solidity language-server package. (2) Avoid running curl | bash blindly (Foundry installer); fetch the script separately and inspect it, or use the official package manager instructions. (3) Never place private keys in plain environment variables on a shared machine; use a hardware wallet, temporary keys, or an isolated environment for deployments. (4) Prefer installing solc/solhint/slither from official, versioned sources and run them in a sandbox or container if you are unsure. (5) Because the skill is instruction-only, the agent will not automatically access your files or keys — but if you tell the agent to run these commands, those commands will run with your user privileges. If you want this skill for IDE LSP features, request or look for a skill that actually installs/configures a language-server (LSP) implementation and cites a trustworthy source.

Type: OpenClaw Skill Name: solidity-lsp Version: 1.0.0 The skill bundle is classified as suspicious due to the use of `curl -L ... | bash` for installing Foundry in `references/frameworks.md`. While this method is common for installing developer tools and the URL points to the official Foundry domain, it represents a high-risk capability as it executes arbitrary code directly from the internet, which could be exploited if the remote server were compromised. There is no clear evidence of intentional malicious behavior like data exfiltration or prompt injection against the agent, but the installation method itself introduces a significant supply chain risk.