Is chrisciszak/boiling-point safe?
https://github.com/openclaw/skills/tree/main/skills/chrisciszak/boiling-point
The boiling-point skill is a legitimate API integration for the Token Layer blockchain platform containing no malicious code, hidden instructions, or prompt injection. Installation was clean with no suspicious network activity or canary file access. However, the skill carries meaningful risks that users must understand: it executes real and irreversible financial transactions on Base mainnet, embeds the skill author's builder wallet address in every transaction without explicit disclosure, sets disableModelInvocation to suppress model-level oversight during financial operations, and creates a complete end-to-end token creation and trading workflow that could be weaponized for pump-and-dump schemes in autonomous contexts.
Category Scores
Findings (8)
HIGH Real-Money On-Chain Transactions with Irreversible Consequences -30 ▶
The skill enables agents to execute signed blockchain transactions on Base mainnet using the user's actual USDC and ETH holdings. Blockchain transactions are irreversible by design. Agent misinterpretation, adversarial prompting, or API errors could result in permanent financial loss. The skill targets a highly speculative asset class (AI/meme tokens on a bonding curve launchpad) with no investor protections.
HIGH Builder Address Embeds Undisclosed Financial Conflict of Interest -25 ▶
The skill hardcodes builder address 0x56926EbCd7E49b84037D50cFCE5C5C3fD0844E7E in all token creation and trade examples. The Token Layer platform uses this to attribute volume, enabling builders to earn platform rewards, fee-share, or preferential treatment. Users are not informed that every transaction they execute benefits the skill author through this attribution. The 'fee: 0' in examples does not preclude server-side platform rewards accruing to the builder.
MEDIUM disableModelInvocation Suppresses Reasoning During Financial Execution -20 ▶
The skill's clawdbot metadata sets disableModelInvocation to true. In the OpenClaw framework this suppresses the model-layer invocation check, meaning the agent may proceed with financial transaction construction and execution without the full reasoning layer evaluating risk, intent alignment, or potential harm. This is particularly concerning in a skill that manages real funds.
MEDIUM Pump-and-Dump Execution Pattern is Fully Documented -15 ▶
The skill provides a complete end-to-end workflow: create a token, receive its tokenId, immediately buy it with the trade-token endpoint. In automated or multi-agent deployments, this pattern enables creating a token at bonding curve launch price and immediately holding a position before any organic buyers, then promoting the token to drive price appreciation. The documented anti-sniping mechanism reveals awareness of and accommodation for MEV-style frontrunning behavior.
MEDIUM Comprehensive Financial Profile Exfiltrated to Third-Party API -20 ▶
Every API interaction transmits sensitive financial data — wallet addresses, USDC/ETH balances, token holdings, transaction history, and fee earnings — to api.tokenlayer.network. This creates a comprehensive financial profile of the user stored in a third-party system the user cannot audit, control, or delete. The /get-user-portfolio, /me, and /get-user-fees endpoints are particularly sensitive.
LOW Referral Code Promoted as Default User Action -10 ▶
The skill recommends applying referral code 'OPENCLAW' as an optional but featured step, claiming users receive 4% cashback. Referral systems typically reward both the referred user and the referrer. It is not disclosed who registered the OPENCLAW code or whether the skill author, platform operator, or a third party receives the referral benefit. This is a low-severity financial steering concern rather than a security threat.
INFO Installation Clean — No Suspicious Network Activity 0 ▶
The skill installation connected only to github.com (skill repo clone via HTTPS) and Ubuntu apt repositories (routine package list update). No connections were made to api.tokenlayer.network, no unexpected processes were spawned, and no files were written outside the skill directory. The installation process was consistent with a passive markdown-only skill.
INFO All Canary Files Intact — No Credential Exfiltration 0 ▶
Honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/application_default_credentials.json) were accessed only by the Oathe audit framework for setup and verification — no exfiltration to external endpoints was detected. The skill has no mechanism to read filesystem credentials and made no attempt to do so.