Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/obolnetwork/obol-stack/inspectnpx skills add ObolNetwork/obol-stack --skill inspectgit clone --depth 1 https://github.com/ObolNetwork/obol-stackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00107 | $0.02305 |
| Opus 5 | $0.00053 | $0.01153 |
| Sonnet 5 | $0.00021 | $0.00461 |
| Haiku 4.5 | $0.00011 | $0.00231 |
Grade A, and why
inspect scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
metadata: { "openclaw": { "emoji": "🔎", "requires": { "bins": ["python3", "cast", "curl"] } } } How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Inspect
Decode before you sign. Vet before you pay. Two read-only tools for the moment right before money or authority leaves the wallet:
scripts/decode.py— what does this calldata / transaction DO?scripts/contract.py— who or what is this address, really?
When to Use
- About to sign unfamiliar calldata or an EIP-712 payload (e.g. the Permit2
approval printed by
buy-x402) —decode.py calldata - Reviewing a transaction someone sent, or auditing one you already sent —
decode.py tx <hash> - About to pay a new or unknown x402 seller —
contract.py check <payTo> - Vetting a counterparty token or contract before approving/holding it —
contract.py check <token>(source verified? proxy? labeled?) - Deciding whether an address is a wallet or code —
contract.py code(detects EIP-7702 delegated EOAs) - Turning an ENS/Basename into an address (or back) —
contract.py resolve
When NOT to Use
- Making the actual payment — use
buy-x402 - Generic RPC reads (balances, blocks, logs) — use
ethereum-networks - Signing or sending transactions — use
ethereum-local-wallet - Discovering sellers on the ERC-8004 registry — use
discovery
Quick Start
# What am I about to sign? (ERC-20 selectors decode fully offline)
python3 ${OBOL_SKILLS_DIR:-/data/.openclaw/skills}/inspect/scripts/decode.py calldata \
0xa9059cbb000000000000000000000000ab5801a7d398351b8be11c439e05c5b3259aec9b00000000000000000000000000000000000000000000000000000000000f4240
# selector: 0xa9059cbb
# function: transfer(address,uint256)
# address: 0xAb5801a7D398351b8bE11C439e05C5B3259aeC9B
# uint256: 1000000 [1e6]
# Who am I about to pay? Composite due-diligence on the payTo address.
python3 ${OBOL_SKILLS_DIR:-/data/.openclaw/skills}/inspect/scripts/contract.py check \
0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 --network mainnet
# -> code / proxy / verified source / labels / ENS+Basename sections
# What did this transaction do?
python3 ${OBOL_SKILLS_DIR:-/data/.openclaw/skills}/inspect/scripts/decode.py tx \
0xa2b4273e... --network mainnet
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 157 lines · 107 tokens per session scan A e41cf969e975
inspect is a skill published in the GitHub repository ObolNetwork/obol-stack (11 stars, last pushed 2d ago), licensed Apache-2.0. It adds 107 tokens to every session and 2,305 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kurtosis-ethereum
Run Ethereum multi-client devnets using Kurtosis and the ethpandaops/ethereum-package. Use for spinning up local devnets, syncing public testnets, validating cross-client interop, testing fork transitions, shadowforks, running assertoor checks, debugging CL/EL client interactions, or verifying new feature…
nvca-chart-release
Release NVCA Operator chart changes from the native monorepo source to the vendored Helm chart. Use when updating the vendored NVCA Operator chart, changing NVCA image refs, publishing helm-nvca-operator, or validating the chart against a self-managed control plane.
nvca-values-customization
Customize NVCA Operator Helm chart values in the native monorepo. Use when modifying vendored defaults, changing stack-derived install values, adding deployment-time overrides, or updating scripts under deploy/helm/nvca-operator.
nvca-self-managed-install
Install or validate the NVCA Operator chart against a self-managed NVCF control plane from the native monorepo. Use when the control plane comes from deploy/stacks/self-managed and NVCA must be installed with stack-derived image repository settings.
test-skill
A minimal test skill for e2e testing of the skill pack resolver.
release-chart
Cut and publish a new release of the Zabbix Helm chart in this repository, following the versioning rules and maintainer release process documented in CONTRIBUTING.md and CLAUDE.md (bump Chart.yaml/artifacthub-pkg.yml/values.yaml, regenerate docs, tag the release so CI publishes it). Trigger on requests like "release…