Etherlink blockchain interaction - EVM-compatible L2 on Tezos. Supports mainnet and shadownet testnet via MCP server. Use for balance checks, transactions, smart contracts, and token operations on Etherlink.
Security Analysis
medium confidenceThe skill is generally coherent with a blockchain helper but has inconsistencies and operational instructions that ask you to run third-party MCP server processes that may require private keys; because the source/homepage are unknown and env var names/instructions are inconsistent, proceed with caution and verify upstream code before using write operations.
Skill name/description (Etherlink EVM-on-Tezos RPC operations) aligns with the included files (SKILL.md, network references, test script). It does not request unrelated credentials or binaries in metadata. However the runtime instructions require running an MCP server (npx/bun/clone a repo) to perform write operations — this is reasonable for a blockchain proxy but the skill's published metadata declares no source/homepage which reduces transparency.
SKILL.md stays on-topic (configure MCP server, use network names, RPC calls). It instructs adding an MCP server entry to the agent config and shows examples that set PRIVATE_KEY/EVM_PRIVATE_KEY environment variables for write operations. That is expected for signing transactions, but the instructions also give multiple different env var names (EVM_PRIVATE_KEY vs PRIVATE_KEY) and point to running code from npm/GitHub; those steps give the agent/user permission to run third‑party code and to store private keys in process environment variables.
There is no formal install spec in the skill itself (instruction-only). The docs recommend using npx (pulling an npm package) or cloning a GitHub repo and running via bun. Using npx/clone is typical but introduces moderate risk because it executes third-party code. No suspicious or obfuscated download URLs were present, but a placeholder GitHub repo (yourusername/etherlink-mcp-server) reduces assurance about the actual upstream source.
The skill metadata declares no required env vars, which is appropriate for read-only actions. The documentation and examples, however, instruct users to provide PRIVATE_KEY/EVM_PRIVATE_KEY (for write operations) and RPC_URL overrides. Requesting a private key for signing transactions is proportionate to providing write capability, but users must understand this exposes a sensitive secret to the MCP process. The inconsistent env var names are confusing and should be clarified before use.
The skill does not request always:true, does not alter other skills' configs, and is agent-invocable by default (normal). The only persistence-related action shown is instructing how to add an MCP server to the agent config, which is expected for this kind of skill.
Guidance
This skill appears to be a legitimate Etherlink (EVM-on-Tezos) helper, but exercise caution before using write functionality. Key points to consider: - Source transparency: the package's source/homepage are missing and references include a placeholder GitHub repo. Verify the upstream npm package or GitHub repository (etherlink-mcp-server) before running npx or cloning — confirm it is the official project. - Private keys: examples show running an MCP server with PRIVATE_KEY / EVM_PRIVATE_KEY in environment variables. Never paste your mainnet private keys into third-party processes you haven't audited. Prefer read-only usage or use a throwaway/test key on Shadownet. - Env var inconsistency: the docs alternate between EVM_PRIVATE_KEY and PRIVATE_KEY. Confirm which variable the MCP server actually uses to avoid accidentally exposing secrets. - Third‑party code risk: npx or bun run will execute code downloaded from npm/GitHub. Run these in an isolated environment (sandbox/container) and review the package source if possible. - Network endpoints: the included test script queries public RPC endpoints; those calls leak your IP and timing info to the RPC operator. If privacy or rate limits matter, run your own node or vetted RPC provider. If you plan only to read chain data, you can use the skill without supplying keys, but for any transaction signing or deployment, verify the MCP server source and avoid using real private keys until you audit the code. If you want higher assurance, request the upstream repository URL, or ask the publisher to provide a verifiable homepage and the official npm/package identity before installation.
Latest Release
v1.0.1
Etherlink skill version 1.0.1 - Added detailed SKILL.md documentation, including usage instructions, supported networks, and troubleshooting. - Clarified Etherlink network selection, RPC endpoints, and explorer links for both mainnet and testnet. - Outlined supported and unsupported JSON-RPC endpoints. - Included Etherlink-specific notes, such as native XTZ currency and no EIP-1559 support. - Provided quick-start configuration for MCP server integration. - Linked to official Etherlink resources and testnet faucet.
More by @efekucuk
Published by @efekucuk on ClawHub
