The Agent Skills Directory

[EXTERNAL_DOWNLOADS] (HIGH): The skill uses npx awal@latest in multiple commands (status, show, address, balance). Using the @latest tag ensures that the agent fetches and runs the most recent version of the package from the npm registry at runtime, which bypasses version pinning and security auditing.
[REMOTE_CODE_EXECUTION] (HIGH): The package awal is maintained by an unverified third-party ('0xrag'/'openclaw'). Because npx executes the downloaded code immediately, an attacker who gains control of the awal npm package could execute arbitrary commands on the user's system with the permissions of the AI agent.
[COMMAND_EXECUTION] (MEDIUM): The skill is granted permission to run bash commands that interact with a cryptocurrency wallet. While these commands are intended for funding the wallet, they provide a high-privilege surface for an unverified external dependency to exploit.

fund