Skill

Capability contract not published. No trust telemetry is available yet. 2.5K downloads reported by the source. Last updated 10/9/2026.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Vendor

Clawhubvendor · observed Oct 9, 2026

Protocol compatibility

OpenClawcompatibility · observed Oct 9, 2026

Adoption signal

2.5K downloadsadoption · observed Oct 9, 2026

Latest release

1.14.0release · observed Oct 5, 2026

Handshake status

UNKNOWNsecurity

1. Install using `clawhub skill install s17e3gjpsxfdsgxv67gc3hm3tx83g435:evalanche` in an isolated environment before connecting it to live workloads.
2. No published capability contract is available yet, so validate auth and request/response behavior manually.
3. Review the upstream CLAWHUB listing at https://clawhub.ai/ijaack/evalanche before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-ijaack-evalanche/snapshot"

• Card JSON
• Facts JSON
• Snapshot JSON
• Contract JSON
• Trust JSON

{
  "facts": [
    {
      "factKey": "vendor",
      "category": "vendor",
      "label": "Vendor",
      "value": "Clawhub",
      "href": "https://clawhub.ai/ijaack/skills/evalanche",
      "sourceUrl": "https://clawhub.ai/ijaack/skills/evalanche",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T13:48:51.294Z",
      "isPublic": true
    },
    {
      "factKey": "protocols",
      "category": "compatibility",
      "label": "Protocol compatibility",
      "value": "OpenClaw",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-ijaack-evalanche/contract",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-ijaack-evalanche/contract",
      "sourceType": "contract",
      "confidence": "medium",
      "observedAt": "2026-10-09T13:48:51.294Z",
      "isPublic": true
    },
    {
      "factKey": "traction",
      "category": "adoption",
      "label": "Adoption signal",
      "value": "2.5K downloads",
      "href": "https://clawhub.ai/ijaack/evalanche",
      "sourceUrl": "https://clawhub.ai/ijaack/evalanche",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T13:48:51.294Z",
      "isPublic": true
    },
    {
      "factKey": "latest_release",
      "category": "release",
      "label": "Latest release",
      "value": "1.14.0",
      "href": "https://clawhub.ai/ijaack/evalanche",
      "sourceUrl": "https://clawhub.ai/ijaack/evalanche",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-10-05T21:53:15.987Z",
      "isPublic": true
    },
    {
      "factKey": "handshake_status",
      "category": "security",
      "label": "Handshake status",
      "value": "UNKNOWN",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-ijaack-evalanche/trust",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-ijaack-evalanche/trust",
      "sourceType": "trust",
      "confidence": "medium",
      "observedAt": null,
      "isPublic": true
    }
  ],
  "events": [
    {
      "eventType": "release",
      "title": "Release 1.14.0",
      "description": "# Evalanche v1.14.0 — Avalanche SDK and L1 hardening This feature release strengthens Avalanche as Evalanche's default execution environment. ## Highlights - Make Avalanche the hardened default with the official `@avalanche-sdk/client`, removing the legacy Core wallet and vulnerable HPKE dependency trees from fresh consumer installs. - Expand Avalanche L1 support with live mainnet and Fuji catalog discovery, RPC chain ID verification, native-token preservation, and public SDK/MCP helpers. - Remove the dYdX SDK, exports, MCP tools, holdings detector, and transitive Cosmos dependencies; Hyperliquid remains the supported perpetuals integration. - Harden X/P/C address routing, offline signing, atomic import/export polling, network switching, HTTP cancellation, response limits, audit parsing, and release automation. - Require Node.js 20 or newer and pin `@scure/[email protected]` because Avalanche SDK 0.1.3 imports it without declaring the runtime dependency. ## Install ```sh npm install [email protected] ``` Avalanche remains the default network. Fresh plain, configured, and `--omit=optional` consumer installs must all report zero production vulnerabilities and must not resolve Core, HPKE, or dYdX packages. ## Migration requirements This maintainer-directed minor release includes compatibility changes that consumers must review: - The runtime floor moves from Node.js 18 to Node.js 20. - dYdX APIs and MCP tools are removed. Use Hyperliquid for perpetuals. - X/P/C implementation types from the legacy Core SDK are no longer part of the package surface. Evalanche's documented X/P/C methods remain available through the new adapter. - Avalanche L1 wallets are EVM-only. X/P-chain signing remains scoped to Avalanche C-Chain and Fuji. ## Security The Core dependency chain pinned `@hpke/[email protected]`, affected by CVE-2025-64767 / GHSA-73g8-5h73-26h4. No matching concurrent sender-context exploit was found in Evalanche's observed flow, but v1.14.0 removes the vulnerable dependency instead of relying on consumer root overrides. Repository and clean consumer production audits report zero vulnerabilities at every severity. The remaining override recipe covers unrelated transitive compatibility pins and is validated against the installed tree. ## Validation and limitations - 589 tests across 50 files, type checking, ESM/CJS/DTS builds, package validation, and documentation parity passed locally. - The packed tarball passed plain, configured, and `--omit=optional` clean installs, ESM/CJS loading, deterministic X/P derivation, offline signing, and dependency-absence checks. - Live read-only checks passed for Avalanche, Fuji, Robinhood Chain, Hyperliquid, Polymarket, and LI.FI quote construction. - No funded X/P/C transaction or other value-bearing action was broadcast. Transaction construction, routing, and signing were verified offline or with mocked RPC; live checks were read-only.",
      "href": "https://clawhub.ai/ijaack/evalanche",
      "sourceUrl": "https://clawhub.ai/ijaack/evalanche",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-10-05T21:53:15.987Z",
      "isPublic": true
    }
  ]
}

Record generated Oct 10, 2026.