twzrd-clawrouter@0.2.1
CAUTION· static onlyPublisher claims: "TWZRD Preflight for ClawRouter / BlockRun / OpenClaw. The independent pre-spend gate for agents using ClawRouter (for LLM models, Surf crypto data, Predexon, voice, image, etc.) or paying BlockRun. The one rule: Before using ClawRouter or paying BlockRun, call free TWZRD preflight (decision=block → abort) and free merchant_card (wash_flagged → do not pay). Composes with AgentCash or direct; Solana-native receipt proof after. Use before any x402 spend through ClawRouter proxy or BlockRun gateway. WHAT YOU GET FREE: ReadinessCard (allow / warn / block + trust_score + caveats) from Solana x402 payer graph before routing spend. PAID (x402, USDC on Solana): full trust + portable Ed25519-signed v6 receipt (when querying TWZRD intel alongside). TRIGGERS: clawrouter preflight, blockrun spend gate, surf data safe, openclaw before pay, pre clawrouter, x402 router gate, blockrun trust, preflight claw" Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-08 and scored it 66/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
npx clawhub install twzrd-clawrouterFix: Pin versions and sources; vendor anything fetched at install time.console.log('Proceeding to ClawRouter proxy call (post preflight gate + hook)...');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.…SE env; must be authentic ClawRouter instance - check version/headers/ps after `npx @blockrun/clawrouter`)'); // Cheap probe (non-fatal; illustrative integrity): reachability + note on id…Fix: Pin versions and sources; vendor anything fetched at install time.Note: the page may show `openclaw skills install twzrd-clawrouter` — that command does not exist. The correct install is `clawhub install` or `npx clawhub install` above.Fix: Pin versions and sources; vendor anything fetched at install time.// Requires: ClawRouter proxy up for the call step (npx @blockrun/clawrouter or via OpenClaw + clawrouter setup).Fix: Pin versions and sources; vendor anything fetched at install time.console.log('Proceeding to ClawRouter proxy call (post preflight gate + hook)...');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.…SE env; must be authentic ClawRouter instance - check version/headers/ps after `npx @blockrun/clawrouter`)'); // Cheap probe (non-fatal; illustrative integrity): reachability + note on id…Fix: Pin versions and sources; vendor anything fetched at install time.// Requires: ClawRouter proxy up for the call step (npx @blockrun/clawrouter or via OpenClaw + clawrouter setup).Fix: Pin versions and sources; vendor anything fetched at install time.console.log(' Offline equivalent: npx twzrd-receipt-verifier@^1.3.0 <receipt.json> --pubkey 9V6Pn19kiUA5Rn6JpQfNduanvGt2aXGwsarosNfa2Ldf');Fix: Pin versions and sources; vendor anything fetched at install time.console.log(' Offline equivalent: npx twzrd-receipt-verifier@^1.3.0 <receipt.json> --pubkey 9V6Pn19kiUA5Rn6JpQfNduanvGt2aXGwsarosNfa2Ldf');Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
14 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim twzrd-sol: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.