Is asgherali/usd1 safe?
Yes. asgherali/usd1 is safe to install. Oathe's behavioral security audit gave the usd1 skill by asgherali a trust score of 92/100 with 3 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/asgherali/usd1
Is asgherali/usd1 safe to install?
This skill enables USD1/USDC token transfers via Wormhole. While technically sound and free of malware or explicit exfiltration, it introduces significant financial risk by handling private keys for blockchain transactions. The skill could be weaponized via prompt injection to steal user funds, or keys could be mishandled through logging. The testnet-only default provides some protection.
What security issues were found in asgherali/usd1?
Category Scores
Findings (3)
HIGH Private key handling risk -30 ▶
The skill accepts a privateKey parameter and uses it to sign blockchain transactions. If this key is logged, cached, or transmitted insecurely, funds could be stolen. While the skill itself isn't malicious, it enables high-risk operations.
MEDIUM Transaction data visible in logs -5 ▶
Transaction hashes and wallet addresses are returned in the response. If these logs are captured by the agent or external logging systems, they could expose financial activity.
LOW No sandboxing of financial parameters -5 ▶
The skill accepts amount, toAddress, and privateKey without validation that they come from a trusted source. A compromised prompt could trick the agent into transferring funds to an attacker-controlled address.
Should I install asgherali/usd1?
Oathe's verdict for asgherali/usd1 is SAFE with a trust score of 92/100. Recommendation: Install with caution.