Skills/ClawHub/flow

flow@1.0.0

VERIFIED

Publisher claims: "Use when an agent is about to swap or trade a token on Base and needs the best executable price, a safety verdict, or smart-wallet signals. Flow is a pay-per-call x402 API on Base (no API key): best-execution quotes across Uniswap V3, PancakeSwap V3 and Aerodrome ($0.01), contract safety verdicts ($0.02), and smart-wallet signals ($0.01), settled in USDC via x402 with automatic payment from a local starter wallet." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher flow-executor · joined 6 days agoInstalls 134Last detonated 6d ago
$clawhub install flow
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 91/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:18 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

No other findings across 142 lines in 2 files.