360 Secure SkillHub
360 安全技能中心

Evm Transaction Safety Preview

提供签名或路由 EVM 交易前的免费分诊清单:核对链 ID 与目标合约、解码 calldata 意图、检查金额与授权额度、评估代币/合约风险、确认模拟状态,字段缺失或异常时建议暂停。本身不签名、不广播、不调用外部接口,文中另给出付费工具包的升级路径。

sebastiancoombs
sebastiancoombs
热度 15.99
最近更新 2026-05-15 07:36:46
分类:安全依赖:纯提示词应用场景:工作流 / 模板 / 财务

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add evm-transaction-safety-preview
Metadata
name
evm-transaction-safety-preview
description
Free EVM transaction safety triage for agents before signing txs; routes deep explain/simulate/token-risk checks to the paid ClawMart EVM Transaction Safety Toolkit.

EVM Transaction Safety Preview

Use this free preview when an agent is about to sign or route an EVM transaction and needs a fast, no-payment triage before installing the paid ClawMart toolkit.

What this free preview does

Run a lightweight pre-signing check:

Area Pass signal Common failure
Chain + target Chain id, RPC target, and contract address match the intended action Signing on the wrong EVM chain or interacting with a spoofed contract
Calldata intent Function selector and decoded params match the user’s instruction Blind calldata, unexpected delegatecall/proxy target, hidden approval
Value + allowance Native value and ERC-20 approval amount are expected and bounded Infinite approval, excessive value, unknown spender
Token/contract risk Token has sane metadata/liquidity/ownership signals Honeypot, blacklistable token, owner-controlled tax, low-liquidity bait
Simulation posture A dry run is available or the transaction is paused for review Agent signs without knowing state changes or revert reason

Minimal workflow

  1. Capture chain, from address, to address, value, calldata, and any token/spender being approved.
  2. Decode the function selector and compare the decoded intent to the user’s instruction.
  3. Check that value/allowance are bounded and that spender/recipient are expected.
  4. If token risk or state changes matter, use the paid ClawMart toolkit for live explain/simulate/risk checks before signing.
  5. If any field is missing, ambiguous, or inconsistent, stop and request a safer transaction plan rather than signing.

Paid upgrade path

Install EVM Transaction Safety Toolkit on ClawMart when you need production-backed live checks:

https://www.shopclawmart.com/listings/evm-transaction-safety-toolkit-89902e40

Backends used by the paid package:

  • https://evm-tx-toolkit.mtree.workers.dev/v1/tx/explain — decode and explain confirmed transactions
  • https://evm-tx-toolkit.mtree.workers.dev/v1/tx/simulate — pre-flight simulation and revert/state-change summary
  • https://evm-tx-toolkit.mtree.workers.dev/v1/token/risk_scan — ERC-20 risk scoring

Safety limits

  • Do not request, reveal, or store seed phrases, private keys, session keys, or raw wallet credentials.
  • Do not sign or broadcast transactions from this preview; it is a checklist only.
  • Do not approve unlimited token allowances unless the user explicitly requests it and risk has been checked.
  • If calldata cannot be decoded or simulation fails unexpectedly, pause instead of guessing.

Anti-patterns

  • Treating a friendly dapp name as proof that the to address is safe.
  • Signing approvals before checking spender and allowance.
  • Skipping simulation because a transaction is “small.”
  • Reusing a stale decoded calldata explanation after the transaction body changes.