StonebornBot

High-speed NFT mint bot for Ethereum and EVM chains. Use when the user wants to snipe NFT mints, speed-mint collections, set up multi-wallet minting bots, configure mint sniping with pre-signed transactions, or automate NFT minting across multiple wallets. Supports ERC721A, Archetype contracts, Flashbots, war mode gas, WebSocket monitoring, mempool watching, and batch minting with 100+ wallets.

This skill appears to implement what it claims, but it handles very sensitive data and has some inconsistencies — proceed cautiously. Before running or installing: 1) Review the JavaScript files yourself (or have someone you trust do it) paying attention to network calls that transmit private keys or signed data (bankrSign, bankrSubmit, Flashbots submission, raw RPC broadcasts). 2) Do NOT put your main/private keys or funded wallets into the provided config.json in a repo — use ephemeral/test wallets first. 3) Fix the obvious mismatch: batch-test.js expects config-test-all.json but the instructions create scripts/config.json; ensure test scripts point at the right file. 4) Use isolated environment (throwaway VM or container) and limit network exposure when first testing. 5) If you must use funded wallets, keep only minimal funds and prefer using a hardware wallet for the funding account. 6) Verify external endpoints (cfg.bankr.apiUrl, flashbots.relayUrl, rpcUrls) are correct/trusted before entering API keys. 7) Consider whether using a public npm package install is acceptable in your environment; inspect package.json after setup. If you are not comfortable auditing the code or providing private keys, do not run this skill.

Type: OpenClaw Skill Name: stonebornbot Version: 1.0.0 The skill bundle is classified as suspicious due to its inherent high-risk functionality, specifically the direct handling of private keys for multiple cryptocurrency wallets as configured in `scripts/config.json` (derived from `assets/config-template.json`). While this capability is central to its stated purpose as an 'NFT Mint Bot' and the `references/wallet-management.md` documentation advises users on security best practices (e.g., 'Never commit private keys to version control'), the direct management of private keys within the application's configuration introduces a significant vulnerability risk if the user's environment or configuration file is compromised. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts in `SKILL.md` beyond the skill's stated purpose.