xpr-xmd

Interact with Metal Dollar (XMD) stablecoin to mint, redeem, check supply, collateral reserves, and oracle prices with zero fees and multi-collateral support.

This skill provides read-only analytics and also supports mint/redeem operations that require signing with your XPR private key. Before installing or enabling write actions: 1) Treat XPR_PRIVATE_KEY as extremely sensitive — only supply it if you fully trust the skill and its author. 2) Ask the maintainer to update skill.json and SKILL.md to explicitly list required env vars (XPR_PRIVATE_KEY, XPR_ACCOUNT, XPR_PERMISSION) and describe when they are used. 3) If you only need read-only data, avoid supplying any private key and use the read tools; consider running the included test-read.mjs in an isolated environment to verify read-only behavior. 4) Prefer using a separate account or a key with limited permissions (if possible) for signing, and review the code locally to confirm there are no unexpected network endpoints or exfiltration logic. 5) If you cannot confirm the origin/trustworthiness of the owner (owner id: kn7fkc3h30sk93cx039q57pqj5812pkc, source unknown), avoid providing credentials and treat the skill as untrusted for write operations.

Type: OpenClaw Skill Name: xmd Version: 0.2.11 The skill is classified as suspicious due to a critical discrepancy in its manifest. While the `src/index.ts` code explicitly requires `process.env.XPR_PRIVATE_KEY` and `process.env.XPR_ACCOUNT` for its 'write' operations (`xmd_mint`, `xmd_redeem`), the `skill.json` file declares `"requires": { "env": [] }`. This omission in `skill.json` represents a vulnerability, as it misinforms an agent operator about the sensitive environment variables the skill will attempt to access, potentially leading to accidental exposure or misconfiguration. The code itself performs legitimate blockchain interactions with hardcoded, known contract addresses and does not exhibit other malicious behaviors like data exfiltration to unauthorized endpoints, arbitrary code execution, or persistence mechanisms.