Uniclaw Skill

Trade on UniClaw prediction markets. Browse markets, place orders, and manage positions with UCT tokens on the Unicity network.

This skill will read your Unicity wallet files (mnemonic.txt) and extract the raw private key (via an internal _identity field) to sign requests to an external UniClaw server (default https://api.uniclaw.app). It also includes a hard-coded UNICITY_API_KEY in the code. Before installing: 1) Do NOT point this at a wallet that holds real funds; test with a throwaway/testnet wallet only. 2) Inspect or remove the hard-coded UNICITY_API_KEY or set UNICITY_API_KEY explicitly in your environment if you understand its use. 3) If you don't trust api.uniclaw.app, set UNICLAW_SERVER to a server you control (or audit the remote server endpoints) — the server will accept signed requests generated from your key. 4) Consider running the skill in an isolated environment (container or VM) and reviewing the Sphere SDK usage — accessing (sphere as any)._identity to read privateKey is fragile and risky. If you are uncomfortable exposing your private key or cannot audit the remote server, do not install or use this skill.

Type: OpenClaw Skill Name: uniclaw-skill Version: 0.1.19 The skill is classified as 'suspicious' primarily due to a hardcoded API key (`sk_06365a9c44654841a366068bcfc68986`) found in `lib/wallet.ts`. While this key is used for an 'oracle' within the `@unicitylabs/sphere-sdk` and not directly for user funds or exfiltration, hardcoding any API key is a significant security vulnerability as it exposes a credential that might be intended to be secret or unique per deployment. Additionally, the skill accesses the private key from the `sphere` object's internal `_identity` field in `lib/wallet.ts` for signing requests, which is a sensitive operation, though necessary for the skill's stated purpose and relies on the OpenClaw platform's secure handling of the mnemonic. No evidence of prompt injection, data exfiltration to unauthorized endpoints, or persistence mechanisms was found.