Optionns

Autonomously monitor live sports games and execute micro-bets on one-touch barrier options with instant mockUSDC settlement on Solana Devnet.

This skill appears coherent for autonomous devnet betting, but take these precautions before installing or running it: - Use throwaway/devnet-only keypairs; never point SOLANA_RPC_URL or keys to mainnet or reuse real wallets. - Review the included scripts (especially scripts/signer.py and scripts/optionns.sh) yourself — they perform local signing and will write private key material to ~/.config/optionns/ by default. - Verify the remote API hostname (https://api.optionns.com) independently (DNS, repo, website, or vendor identity). The skill will transmit your wallet address and receive API keys from that endpoint during registration. - Run the skill in an isolated environment (container/VM with restricted permissions and network egress) if you plan to allow autonomous invocation. - Consider pinning and reviewing the pip dependencies (solders, httpx) before pip installing; prefer a virtualenv and inspect packages where practical. - If you need stronger assurance, request a verified source/repository or reproducible build; absence of a trusted upstream (homepage/source unknown) lowers confidence. If you are uncomfortable verifying the remote endpoint or code, do not provide real credentials and avoid enabling autonomous runs that can register or transact on your behalf.

Type: OpenClaw Skill Name: sports Version: 1.0.24 The skill is classified as suspicious due to its reliance on a third-party API (https://api.optionns.com) to provide Solana transaction instructions, which are then signed and submitted locally by the agent. While the skill explicitly enforces 'devnet-only' operation via `signer.py` and `strategy.py` to prevent mainnet interaction, a compromised API could still issue malicious instructions for the devnet, potentially leading to loss of mock funds. The `SKILL.md` and `README.md` are transparent about the skill's operations and security model, including warnings against using mainnet wallets, and do not contain any prompt injection attempts. Input sanitization is present in `optionns.sh` for user-provided arguments, mitigating shell injection risks. The local storage of keypairs with `600` permissions is appropriate, and the use of `solders` for structured transaction signing is robust. The primary concern is the trust placed in the external API for transaction logic, which represents a vulnerability if the API is compromised, rather than intentional malice from the skill itself.