x402janus

x402janus — autonomous on-chain wallet security for EVMs: scan approvals, trace fund flow, detect drainers, and build revoke transactions. Pay via x402 USDC...

This skill largely does what it claims — scanning approvals and building revoke txs — but there are red flags you should address before installing or running it. What to check before installing or running: - Verify provenance: the submitted registry metadata differs from SKILL.md (required envs and binaries). Confirm the source repository/website (https://x402janus.com and the GitHub link in SKILL.md) actually match the code you received. - Do not supply your primary, full‑balance private key. For paid tiers or any run that requires PRIVATE_KEY, use a dedicated agent wallet with minimal funds and only enough USDC to pay micropayments. Prefer ephemeral or watch‑only wallets where possible. - Audit the revoke script carefully: it spawns an external 'cast' process; ensure the implementation does NOT pass your private key on the command line (ps/args exposure) or write it to logs. The source contains comments indicating this may not be fully fixed. - Review network endpoints: the code defaults to third‑party RPCs (tenderly) if BASE_RPC_URL is not set. That can leak which addresses you're interacting with to a third party. Set BASE_RPC_URL to a trusted RPC or your own node. - Consider running in an isolated environment (temporary container or VM) and inspect network traffic when you run the tool, especially first runs and paid-tier flows. - If you only need read-only scans, prefer the Free tier which does not require PRIVATE_KEY. If you need paid tiers, confirm the JANUS_API_URL endpoint is authentic and review the server's 402 challenge flow. If you want, I can: (1) search the provided code for exact places where PRIVATE_KEY may be passed to child processes, (2) extract the exact spawn arguments in the revoke script to confirm whether keys are passed on the CLI, or (3) produce a short checklist/patch suggestions to harden the scripts (avoid CLI args for secrets, require BASE_RPC_URL, add clearer metadata).

Type: OpenClaw Skill Name: x402janus Version: 3.0.0 The skill bundle provides a legitimate security toolkit for EVM wallet forensics and approval management, utilizing the x402 micropayment protocol. The scripts (e.g., scripts/scan-wallet.ts and scripts/revoke-approval.ts) are well-structured, using standard libraries like viem and thirdweb to handle blockchain interactions and EIP-3009 payment signing. While the skill requires a PRIVATE_KEY for paid tiers and on-chain revokes, the implementation is transparent, includes security-conscious practices (such as passing keys to sub-processes via environment variables instead of CLI arguments to avoid process-list exposure), and strictly adheres to its stated purpose of enhancing agent security.