Zhentan

Zhentan is your personal onchain security agent and co-signer. It monitors pending multisig transactions, screens them against behavioral patterns and securi...

This skill is coherently designed for a remote co-signer but hands a single secret to an external service (api.zhentan.me). Before installing: 1) Verify the operator (homepage, company, audits, and reputation). 2) Treat AGENT_SECRET as high‑privilege — don’t reuse it, ensure it can be rotated/revoked, and limit its scope if possible. 3) Prefer testing with a non-production Safe or tiny-value transactions first. 4) Ask for documentation: what exactly the secret authorizes, what logs/events are generated, how proofs of execution are provided, and whether the service returns verifiable on‑chain tx data. 5) If you cannot verify the service or the secret’s limits, do not provide your signing credentials — consider a self-hosted or audited alternative.

Type: OpenClaw Skill Name: zhentan Version: 1.0.2 The 'zhentan' skill acts as a security co-signer for blockchain transactions, interacting with a remote API at api.zhentan.me. While its stated purpose is security monitoring, the SKILL.md file contains multiple instructions for the AI agent to construct and execute shell commands (curl) using unsanitized user inputs (e.g., transaction IDs, Safe addresses, and Telegram user IDs). This creates a significant risk for shell command injection if the agent processes malicious input from a user. Additionally, the skill requires a sensitive AGENT_SECRET which is transmitted to the external domain, and while this is part of its functional design, the high-privilege nature of the tool combined with insecure command templates warrants caution.