caw-eval

SUSPICIOUS: 该 skill 的远端 SSH/SCP、Langfuse 上传、OpenClaw/CAW 调度与其“钱包 agent 评测编排”目的基本一致，不像伪装成无关用途的窃密器；但其实际权限和影响面很大：会分发凭证到远端、上传完整 session 到第三方服务、关闭 SSH 主机校验，并可触发真实钱包/链上操作。最主要问题是安装与执行信任链偏弱，尤其是 raw GitHub curl|bash 的 caw 安装路径与公开文档不完全一致，因此应归为高风险但非确认恶意。

The supplied fragment is malformed and cannot execute as written. It contains no demonstrated credential theft, exfiltration, persistence, or destructive behavior, but its embedded agent instructions encourage pact submission without a confirmation step and therefore pose a consequential-action risk if restored and executed in a wallet-enabled environment. Review the complete, valid source and enforce explicit transaction authorization before use.

No malicious code is present in this documentation fragment. It does expose a credential-shaped Langfuse secret and recommends globally disabling SSH host-key verification; rotate the key if genuine and use a scoped, verified SSH configuration. The documented remote dispatch and asset-transfer actions should be confirmed before execution.

The fragment is a server setup runbook, not evidence of malware. It presents supply-chain and credential-handling risks through unverified curl-to-bash installers, third-party package installation, broad GCP permissions, and printing a secrets file. It also directs an agent to make blockchain transactions without additional confirmation. Use trusted/pinned installers, least-privilege cloud scopes, restrictive secret-file permissions, and transaction controls.