A real-time security scanner that monitors EVM blockchains to detect dangerous arbitrary call injection vulnerabilities in smart contracts.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install arbinjectionskill
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install arbinjectionskill using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ArbInjection?
ArbInjection is a technical security tool designed for the Openclaw Skills collection, focusing on the identification of CALL and DELEGATECALL patterns that permit arbitrary call injections. It serves as an automated auditor for blockchain researchers, providing a robust mechanism to scan bytecode across multiple EVM-compatible chains.
By operating within the Openclaw Skills framework, it allows developers and auditors to maintain a continuous watch over new deployments, ensuring that vulnerabilities are identified the moment they hit the chain. The tool balances automated detection with manual verification requirements to ensure high-fidelity security reporting.
ArbInjection Use Cases
- Background monitoring of new contract deployments on chains like Ethereum, BSC, and Polygon to find vulnerabilities.
- Performing on-demand security scans of specific smart contract addresses during the auditing process.
- Automating security alerts to messaging platforms when critical injection risks are detected in the wild.
- Enhancing educational security research by analyzing bytecode patterns through the Openclaw Skills interface.
How ArbInjection Works
- The skill connects to specified EVM chains and subscribes to new block events to monitor contract deployments.
- Upon detecting a new contract, the system retrieves and analyzes the contract bytecode for specific vulnerability signatures.
- A severity verdict is assigned based on the level of user control over call targets and calldata.
- Detailed reports are generated in both JSON and Markdown formats and stored in a structured results directory.
- If a high or critical risk is identified, the skill triggers a notification through integrated messaging tools to alert the user.
ArbInjection Setup
To install this component of your Openclaw Skills library, follow these steps:
git clone https://github.com/BringYourOwnBot/arb-injection.git
cd arb-injection
npm install
To launch a monitoring session for a specific chain:
node index.js eth
ArbInjection Data Schema & Taxonomy
The skill organizes scan data within a local results folder, ensuring that findings are easily accessible for further analysis. The data is structured as follows:
| Format | Description |
|---|---|
| .json | Machine-readable technical metadata including contract address and vulnerability markers. |
| .md | Human-readable reports containing the verdict, risk assessment, and explorer links. |
| .env | Configuration file for managing API keys and custom output paths. |
ArbInjection Advanced Features
- Integrated LLM support using Anthropic for deep contextual analysis of flagged vulnerabilities.
- Multi-chain compatibility supporting Ethereum, Base, Arbitrum, Optimism, Polygon, and Hyper.
- Automated maintenance workflows that utilize cron jobs for daily updates within the Openclaw Skills environment.
- Sophisticated false-positive filtering to ignore safe patterns like EIP-1167 proxies and hardcoded delegate targets.
SKILL.md
Loading
Related Openclaw Skills
Scrapling Web Scraping Skill
An advanced web scraping engine for Openclaw Skills featuring anti-bot bypass, JavaScript rendering, and self-healing adaptive selectors.
Unity Level Design
A comprehensive automation toolkit for rapidly prototyping Unity environments and gameplay systems through AI-driven editor scripts.
Game Developer
A specialized AI agent skill designed to architect, implement, and optimize high-performance games using Unity, Unreal Engine, and ECS patterns.
Fuku Sportsbook Agent Skill
An automated sports betting and data analysis skill for creating AI agents that track odds, post picks, and manage virtual or real USDC bankrolls.
Kamino Positions Monitor
A professional-grade monitor for Solana wallets that tracks Kamino Lend positions, provides liquidation risk reports, and suggests actionable safety measures.
DoubleTick
DoubleTick enables AI agents to send tracked emails through Gmail and monitor real-time open status, device info, and engagement metrics.
Featured*
