Teneo-Protocol-CLI

Execute Teneo Protocol agent commands and handle x402 USDC payments on Base, Avalanche, PEAQ, and XLayer. Query agents, send commands, manage rooms, and proc...

This skill could legitimately need a generated wallet to pay Teneo agents, but there are several red flags you should resolve before installing or funding any wallet it creates: 1) Ask the publisher for source code and an install script. The SKILL.md names npm packages but the registry entry has no install spec or code — confirm how the SDKs are provided and inspect the implementation (especially wallet encryption + withdrawal logic). 2) Confirm where and how the master encryption secret is derived and stored. The doc mentions a 'master secret' but gives no details; verify it is created locally, with secure permissions, and never transmitted. 3) Require explicit config-path declaration and an option to use an external signer. The skill writes to ~/.teneo-wallet/ but the metadata doesn't declare this; ask for the exact files it will create and a way to plug in a hardware or external wallet instead of auto-generating keys. 4) Do not fund any wallet until you can audit the code and the backend. Use a tiny test amount first, and prefer running the skill in an isolated VM or container. 5) Verify the backend endpoint and TLS certificate (wss://backend.developer.chatroom.teneo-protocol.ai) and review the referenced SDK on npm/GitHub to ensure it matches the publisher's claims. 6) Consider disabling autonomous invocation or limiting network access for the agent while you evaluate it; persistent wallet-writing plus autonomous execution increases blast radius. If the publisher cannot provide source, install instructions, or clear secret-management details, treat this skill as untrusted for handling real funds.

Type: OpenClaw Skill Name: teneoprotocolcli Version: 1.0.3 The skill bundle 'teneoprotocolcli' provides a CLI for interacting with the Teneo Protocol, involving AI agent queries and USDC micropayments. It automatically generates a crypto wallet, stores the private key encrypted at rest in '~/.teneo-wallet/', and includes a listener ('registerTxSigner' in 'teneo.js') that automatically signs and broadcasts transactions requested by the remote Teneo WebSocket server (wss://backend.developer.chatroom.teneo-protocol.ai). While these capabilities are aligned with the stated purpose of the protocol, the automated signing of remote transaction requests poses a significant security risk, as a compromised backend could potentially drain the wallet. The skill also includes a command to export the private key in plaintext. These high-risk financial capabilities, combined with the requirement for the agent to manage a funded wallet, warrant a suspicious classification, although no clear evidence of intentional malice or exfiltration of existing user secrets was found.