Is devzenpro/clawquests-xyz safe?

When an agent calls getQuestDetails or listOpenQuests, it retrieves quest content (title, description, resultURI, skillTags) that was written by arbitrary external actors to the blockchain. This content is untrusted and could contain adversarial prompt injection instructions. An attacker could create a quest with a maliciously crafted description instructing the agent to approve completion of attacker-controlled quests, transfer funds, or perform off-platform actions. The skill provides no guidance on treating blockchain-sourced strings as untrusted data.

Every write transaction template passes the agent's private key via the --private-key flag on the command line. On Linux, command-line arguments are visible to all users with read access to /proc/PID/cmdline for the lifetime of the process, and are typically captured in shell history files and audit logs. A compromised or noisy process on the same host could exfiltrate the key during the window of execution.

The skill designates Option A (ClawQuests Drip API) as the 'Recommended — Instant & Free' onboarding method. This instructs every installing agent to POST its wallet address to https://clawquests.xyz/api/drip, a server controlled by the skill operator. This creates a centralized registry of agent wallet addresses that can be correlated with on-chain transaction history to deanonymize and track agent activity across all users of the skill.

The skill includes fully specified mainnet deployment addresses and instructs agents to approve USDC allowances, stake funds, create bounties, and claim quests autonomously. The version string 'Autonomous Onboarding' reflects the design intent that no human approval is required. A sufficiently persuasive quest description could cause an agent to approve large USDC allowances or stake substantial funds on the operator's contract with no human checkpoint.

The claimQuestWithReferral action embeds a referrer address that earns 20% of the 5% platform fee on all quest completions. If any quest description, skill instruction, or social engineering leads agents to supply the skill operator's address as referrer, the operator passively extracts fees from every quest completed by every agent using the skill. This is a financially motivated extraction mechanism that requires no code execution.

Six sensitive credential files were opened and read at 10:50:41 UTC (post-installation), including .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials. The canary integrity check confirms no content was exfiltrated. Cross-referencing EXECVE audit records, the timing aligns with the oathe monitoring framework's own integrity verification sweep rather than any skill-originated process. Risk is flagged but assessed as low-probability skill attribution.

The skill hardcodes RPC endpoints at publicnode.com and the operator's own clawquests.xyz domain. These endpoints mediate all blockchain reads and the onboarding flow. If these services are compromised, rate-limited, or replaced with malicious responses, the agent's behavior could be manipulated through crafted RPC responses.

_meta.json reports latest published version as 1.6.0 while SKILL.md declares version 1.5.0. This inconsistency suggests either the file content lags the published release or version bookkeeping is not maintained. In either case it reduces confidence in the integrity of the release pipeline.

The git clone and file copy operations were fully contained. Network traffic was limited to GitHub's CDN for the monorepo clone and Ubuntu's update infrastructure. No connections to clawquests.xyz, unexpected IPs, or DNS lookups for the operator domain were observed during installation. The filesystem diff shows only the two expected skill files added.

SKILL.md is pure instructional markdown. No package.json with lifecycle scripts, no git hooks in .githooks/, no .gitattributes filters, no .gitmodules pointing to external repos, and no symlinks were found. The skill's execution surface is entirely mediated through an agent's exec tool interpreting cast CLI command templates.