arb-injection

What This Skill Does

The ArbInjectionSkill is a specialized security auditing tool for the OpenClaw agent designed to scan EVM-compatible smart contracts for arbitrary call and delegatecall vulnerabilities. Arbitrary call injection is a critical security flaw where an attacker can influence the destination of a contract's external calls, potentially draining funds or manipulating contract state. This skill monitors blockchain networks in real-time, inspects bytecode for risky patterns, and maintains a local database of scan findings. It includes logic to distinguish between dangerous user-controlled calls and legitimate architectural patterns like proxies or DEX callbacks.

Installation

To install the skill, use the OpenClaw CLI: clawhub install openclaw/skills/skills/dexiaong/arb-injectionwfd. Ensure you have an active Node.js environment installed. After installation, you may optionally configure an .env file with your ANTHROPIC_API_KEY to leverage LLM-based analysis for improved false-positive filtering during the scanning process.

Use Cases

This skill is intended for smart contract auditors, bug bounty hunters, and developers who need to secure their deployments. Common use cases include: 1) Monitoring newly deployed contracts on major L1/L2 networks (BSC, ETH, Arbitrum, etc.) for emerging threats. 2) Conducting on-demand security audits of existing contracts before integrating them into a protocol. 3) Automating vulnerability notification workflows to receive instant alerts via Telegram or Discord when a critical risk is identified.

Example Prompts

1. "OpenClaw, scan contract 0x7a10... on BSC for arbitrary call vulnerabilities and report findings."
2. "Start monitoring the Ethereum network for new deployments and alert me immediately if any contract shows a CRITICAL verdict."
3. "Check the most recent scan report in the results folder and explain why the 0x123... contract was flagged as a high risk."

Tips & Limitations

To minimize noise, the skill utilizes built-in filtering for known safe patterns such as EIP-1167 proxies, UUPS/Transparent proxies, and common utility libraries like Multicall3. Always verify findings manually before acting, especially for high-value targets. Be aware that the skill performs local file system operations to store findings and requires network access to query RPC nodes. The efficacy of the scan depends on the quality of the RPC endpoint provided; consider using high-performance nodes for real-time monitoring to avoid missing block events.