Caveat verdict
clawlaunch
Accesses agent memory/notes AND makes external network calls
Enables the agent to launch ERC-20 tokens and execute real on-chain trades on Base mainnet using an API key; autonomous real-money crypto transactions without per-action user approval.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but Caveat detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Accesses agent memory/notes AND makes external network calls — may leak personal data
LLM02 · LLM07 · ASI03 · ASI06
Accesses credentials AND makes external network calls — potential credential theft
LLM02 · ASI03
Accesses agent memory AND makes external network calls — may leak conversation history
LLM02 · LLM07 · ASI06
Permission integrity
credential_access
agent_memory
Findings (7)
Possible hardcoded credential
SKILL.md · code · API_KEY="${CLAWLAUNCH_API_KEY:-}
Accesses process.env — reads environment variables
SKILL.md · code
Python os.environ.get — reads environment variable
SKILL.md · code · os.environ.get(
Accesses sensitive environment variables
SKILL.md · code · process.env.CLAWLAUNCH_API_KEY
POSTs data to external URL
references/api-docs.md · code · .post(
'https://
fetch() — outbound network request
SKILL.md · code
Makes HTTP request to external URL
references/api-docs.md · code · fetch('https://
Permissions & capabilities
Requires 2 system binaries. (1 elevated: curl).
credential_accessagent_memorynetwork_out Thanks — recorded.