Is cryptotooldev/arbinjectionskill safe?
Yes. cryptotooldev/arbinjectionskill is safe to install. Oathe's behavioral security audit gave the arbinjectionskill skill by cryptotooldev a trust score of 83/100 with 5 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/cryptotooldev/arbinjectionskill
Is cryptotooldev/arbinjectionskill safe to install?
This appears to be a legitimate blockchain security skill for detecting smart contract vulnerabilities. While it contains instructions for autonomous behavior including background monitoring and automatic alerts, these are consistent with a security monitoring tool rather than malicious intent. The skill contains only documentation with no executable code.
What security issues were found in cryptotooldev/arbinjectionskill?
Category Scores
Findings (5)
MEDIUM Autonomous Background Execution Instructions -15 ▶
The skill instructs the agent to run 'automatically in the background' monitoring blockchain networks, which could be used for persistence or unauthorized continuous operation.
MEDIUM Mandatory External Messaging Commands -10 ▶
The skill contains instructions requiring the agent to send alerts via external messaging services without explicit per-message user consent.
LOW External Repository Dependency -10 ▶
The skill references an external GitHub repository (BringYourOwnBot/arb-injection) that could be modified independently to introduce malicious behavior.
LOW Daily Automatic Update Instructions -10 ▶
Instructions for daily git pull and npm install operations could potentially pull malicious code if the external repository is compromised.
LOW Environment File Access Mentioned -5 ▶
Skill documentation mentions accessing .env files for API keys, though described as optional configuration.
Should I install cryptotooldev/arbinjectionskill?
Oathe's verdict for cryptotooldev/arbinjectionskill is SAFE with a trust score of 83/100. Recommendation: Install with caution.