Clawlet - Nostr 智能管家。用于管理 Nostr 身份、发布内容、关注用户、读取时间线、AI筛选、智能推荐、私信功能、昵称管理。当用户要求生成 Nostr 身份、发消息到 Nostr、关注某人、查看时间线、设置兴趣、发现推荐用户、发送私信、查看私信、添加昵称时使用。

This skill appears to do what it claims: it's a Nostr helper that generates keys, talks to the listed relays, and stores identities in data/identities.json. Before installing: (1) Inspect the identities.json file location and set restrictive filesystem permissions (don't leave private keys world-readable). (2) Consider running the skill in an isolated environment/container if you don't fully trust the source. (3) If you will publish sensitive content or use important identities, back up keys securely and verify the GitHub repository/source before use. (4) Note that the skill will network to the listed relays (public Nostr relays) when used; if you don't want automatic network activity, avoid invoking the skill or disable autonomous invocation at the platform level.

Type: OpenClaw Skill Name: clawlet Version: 1.2.0 The skill is classified as suspicious primarily due to its handling of Nostr private keys. It stores private keys locally in `data/identities.json` and provides an explicit function (`clawlet_identity_export` in `index.js`) to export these keys to the AI agent/user. While the `SKILL.md` includes a security warning about private key management and the export function returns a warning, this capability represents a significant vulnerability. If the AI agent or the user's environment is compromised, or if the user is socially engineered, this function could be exploited to steal private keys. This is a risky capability that, while transparent, poses a high security risk, even without clear evidence of intentional malicious exfiltration by the skill itself.