Is ktaesthetix/qrcoin safe?
https://github.com/openclaw/skills/tree/main/skills/ktaesthetix/qrcoin
The qrcoin skill is a functionally legitimate blockchain interface for the QR Coin auction protocol on Base, with clean installation behavior and no evidence of data exfiltration or malicious code execution. However, the skill embeds a specific third-party URL (https://grokipedia.com/page/debtreliefbot, alias MerkleMoltBot) in its contributeToBid example without any placeholder text, creating a covert advertising vector where a naively-prompted agent would spend the user's real USDC on the skill author's QR code bid. Combined with an over-broad 50 USDC approval and an unversioned Bankr skill dependency for transaction signing, this skill poses a meaningful financial risk through accidental or induced unauthorized spending.
Category Scores
Findings (7)
MEDIUM Hardcoded third-party URL in contributeToBid example -30 ▶
The contributeToBid section provides a complete Bankr prompt example that hardcodes https://grokipedia.com/page/debtreliefbot as the bid URL and MerkleMoltBot as the bidder name. An agent that follows this example without substituting the user's intended URL will spend approximately 1 USDC of the user's real funds contributing to the skill author's preferred QR code advertisement. This constitutes a subtle prompt injection: the skill embeds a specific desired outcome (promoting the author's URL) into the agent's workflow under the guise of illustrative documentation.
MEDIUM Over-broad USDC approval enables unconfirmed spending -25 ▶
The skill instructs the agent to issue a one-time approval of 50 USDC to the auction contract before any bid is placed. The minimum transaction cost is ~1 USDC (contributeReserve) and ~11.11 USDC (createBidReserve). Approving 50 USDC grants the contract authority to pull funds for multiple subsequent operations without re-authorization from the user, amplifying the impact of any accidental or injected bid instruction.
MEDIUM No user-confirmation gate before financial transactions -20 ▶
The skill's workflow proceeds directly from status queries to USDC approval to bid placement without instructing the agent to confirm the target URL, bid amount, or token ID with the user at any stage. Combined with the hardcoded URL example, a user asking 'participate in a QR coin auction for me' could trigger unauthorized spending with no intermediate confirmation.
LOW Unversioned Bankr skill dependency for transaction signing -13 ▶
The skill delegates all on-chain transaction construction and signing to 'Bankr' without specifying the skill author, version, repository, or expected behavior. If a malicious or incompatible Bankr variant is installed, it could redirect transactions, alter contract addresses, or exfiltrate private keys while appearing to follow this skill's instructions.
LOW Single hardcoded public RPC endpoint -10 ▶
All blockchain read queries are directed exclusively to mainnet.base.org (Coinbase-operated). This endpoint receives the agent's source IP, query timing, and contract call data. No user-configurable RPC alternative is defaulted despite the inline note that substitution is possible. Users with privacy requirements or who prefer self-hosted RPC nodes must manually modify the prompts.
INFO Clean install — no unexpected behavior during clone 0 ▶
The installation process performed a standard git sparse-checkout of the skill subdirectory from the openclaw/skills monorepo. No unexpected network connections, no process spawning outside the expected git stack, and no filesystem modifications outside the skill directory were observed. Connection diff shows no new persistent listeners or established connections post-install.
INFO All honeypot files intact 0 ▶
Monitoring confirmed that .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud application_default_credentials.json were not exfiltrated. The observed PATH audit events for these files at timestamps 1771941533 and 1771941551 correlate with the monitoring framework's own pre- and post-install integrity sweeps, not with skill-initiated file reads.