Upgrade Solidity Contracts

Upgrade Solidity smart contracts using OpenZeppelin proxy patterns. Use when users need to: (1) make contracts upgradeable with UUPS, Transparent, or Beacon...

This is a documentation-only skill about OpenZeppelin upgrade patterns and appears coherent for that purpose. Before installing/using it: (1) verify provenance — the SKILL.md claims OpenZeppelin authorship but the registry metadata lacks a homepage or canonical source; (2) be aware of the AGPL-3.0 license (copyleft implications if you redistribute modified content or ship derived works); (3) when following deployment/upgrade steps, keep private keys and RPC URLs local and do not paste them into the agent unless you explicitly trust the environment; (4) test all upgrades on testnets and review any suggested scripts before running them; and (5) if you expect an official OpenZeppelin resource, prefer downloading documentation from OpenZeppelin's verified site or repositories to avoid provenance issues.

Type: OpenClaw Skill Name: upgrade-solidity-contracts Version: 1.0.1 The skill bundle provides legitimate documentation for Solidity contract upgrades but includes a high-risk instruction in SKILL.md for the agent to execute a Bash command using 'node -e'. This command calculates ERC-7201 storage slots and takes a namespace ID as an argument. While the cryptographic logic is correct, instructing an agent to construct and run shell commands with variable inputs introduces a significant shell injection vulnerability. No evidence of intentional malice, data exfiltration, or backdoors was found.