1sat-stack
Fail
Audited by Socket on May 8, 2026
1 alert found:
MalwareMalware.clawnet/unsigned-skill.json
HIGHMalwareHIGH
.clawnet/unsigned-skill.json
This fragment strongly indicates malicious or highly deceptive supply-chain content: it embeds an obfuscated instruction set (OP_RETURN-like hex plus signer metadata) describing automated blockchain wallet/UTXO/token discovery and subsequent spend/transfer/submit/broadcast transaction actions via HTTP API endpoints, along with monitoring/streaming. Even without the surrounding decoder/executor code, the embedded side-effect workflow and deceptive language make the module extremely high risk and unsuitable for production use until the referenced implementation files are inspected, deobfuscated, and verified to be non-actionable and non-stealing/non-authorizing.
Confidence: 90%Severity: 85%
Audit Metadata