openclaw-ai-metamask-wallet-automation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most listed URLs are legitimate blockchain RPC endpoints (Alchemy, Ankr, Cloudflare, Binance, Polygon) and generally low-risk as download sources, but the GitHub repo (github.com/olot-1477/Openclaw-AI-Metamask-26) from an unfamiliar account that distributes wallet-automation code which requests mnemonics is a high-risk indicator (potential key-theft/malicious code), so the overall set should be treated as moderately high risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto wallet automation framework. It includes direct capabilities for key derivation (WALLET_MNEMONIC), wallet initialization, transaction creation (set_to, set_value, set_data), signing/submission (queue.add_transaction(tx, wallet); mc_router.submit(...); queue.process_async), batching and nonce management, smart-contract token transfers (ERC-20 transfer encode + submit), multi-chain RPC endpoints, and gas optimization. These are concrete APIs to construct, sign and send blockchain transactions (move funds), so it grants Direct Financial Execution authority.