Warren NFT Deploy(mainnet)

Deploy NFT collections permanently on MegaETH mainnet. Images are stored on-chain via SSTORE2, then published through WarrenContainer and WarrenLaunchedNFT.

This skill appears to do what it says: it bundles Node code and compiled bytecode to deploy on MegaETH and requires a PRIVATE_KEY so it can sign transactions. Before using with a valuable wallet, do the following: 1) Manually review deploy-nft.js (search for any HTTP requests that send sensitive data) and confirm REGISTER_API POSTs only public data (contract addresses, token ids, metadata) and not your private key or raw images unless you intend that. 2) Prefer running on a burner/test wallet or small fund first to confirm behavior and gas estimates. 3) Inspect thewarren.app endpoint (REGISTER_API) and the referenced GitHub repo (metadata lists a source URL) to verify the operator/trustworthiness. 4) Note setup.sh runs npm install — run it in an isolated directory or container to avoid polluting your environment. 5) If you are uncomfortable, ask the skill publisher for audited source or run the scripts against a testnet or forked node first.

Type: OpenClaw Skill Name: warren-nft-mainnet Version: 1.0.8 The skill bundle is classified as benign. The `SKILL.md` transparently outlines the skill's purpose, prerequisites, and network interactions. The `setup.sh` script is minimal, only installing the `ethers` library. The `deploy-nft.js` script uses `ethers.js` for all blockchain operations, handling the `PRIVATE_KEY` in memory for transaction signing without logging, storing, or exfiltrating it. Network communication is limited to the specified MegaETH RPC and an optional registration API (`thewarren.app/api/container-nfts`), which only receives collection metadata, not sensitive data or images. File system access is restricted to the user-specified image folder. There is no evidence of prompt injection attempts against the OpenClaw agent, malicious execution, persistence mechanisms, or obfuscation.