Is codecustard/kaspa-dev safe?
https://github.com/openclaw/skills/tree/main/skills/codecustard/kaspa-dev
The codecustard/kaspa-dev skill is a comprehensive Kaspa blockchain development reference containing documentation, SDK guides, and utility scripts. No malicious content was found in SKILL.md or any reference file, and the canary integrity check confirmed no honeypot credentials were exfiltrated. Sensitive credential file accesses observed in the monitoring logs are attributable to the oathe monitoring framework's own setup and teardown routines based on timestamps that bracket the install event, not to any skill code.
Category Scores
Findings (4)
LOW Canary credential files read during monitoring window -12 ▶
Six sensitive credential files were opened (read-only) at two points in the monitoring session. Chronological analysis of auditd timestamps establishes that both access events originate from the oathe monitoring framework itself: the first batch at 1771927884 precedes the install command at 1771927889, and the second batch at 1771927901 follows the final monitoring check at 1771927901.369. The canary integrity report confirms all files remain unmodified and no network exfiltration was observed.
LOW Python utility scripts included in skill -15 ▶
The skill ships scripts/generate-address.py and scripts/build-transaction.py. These are described as utilities for generating Kaspa addresses and building transactions. They are not auto-executed during or after installation, and no install hooks invoke them. They would only run if a user or agent explicitly executes them.
INFO Blockchain RPC code examples reference external node endpoints -5 ▶
Code samples across multiple reference files connect to wss://api.kaspa.org for RPC operations including balance queries, UTXO fetching, and transaction submission. This is standard and necessary for Kaspa development. However, if an agent executing this code were simultaneously handling sensitive key material provided by a user, that material would pass through the agent's context alongside code that establishes external connections.
INFO Blockchain private key handling creates elevated social engineering surface -10 ▶
This skill provides detailed instruction on generating, importing, and signing with private keys across Rust, Go, JavaScript, and Python. An attacker who can craft social engineering prompts against an agent using this skill could potentially direct the agent to generate a key, use it to sign a transaction to an attacker address, or log key material. The skill itself does not facilitate this, but awareness of the elevated surface area is warranted.