kaspa-wallet

Send and receive KAS cryptocurrency. Check balances, send payments, generate wallets.

This package mostly does what it says (a CLI Kaspa wallet) but contains a few important red flags you should address before use: - Do not run this on a machine that holds real funds until you vet it. The code requires a private key or mnemonic via environment variables; those are sensitive values. - The installer pulls the 'kaspa' package from PyPI with no version pin. Verify the 'kaspa' package on PyPI (author, downloads, homepage) and prefer a pinned, audited dependency. Consider running install in an isolated VM or container. - The registry metadata omits the required env vars; that mismatch is suspicious—assume the skill requires a wallet secret and treat it accordingly. - Review the included scripts (install.py and scripts/kaswallet.py) locally. If you can't audit the code, consider using ephemeral testnet keys (KASPA_NETWORK=testnet-10) and fund only a small test balance first. - If you decide to install, run the installer in a sandbox (container/VM), inspect what gets installed into .venv, and avoid storing secrets in shared shells or logs. Prefer hardware wallets or a well-known, audited wallet for real funds. If you want, I can: - fetch and summarize the remainder of scripts/kaswallet.py (the file was truncated in the review input) to look for further surprises, - check the PyPI 'kaspa' package metadata, or - suggest minimal changes to harden the installer (pin deps, add checksum/lockfile, declare env requirements in metadata).

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 3 The OpenClaw AgentSkills skill bundle for the Kaspa Wallet is classified as benign. The code and documentation are clearly aligned with its stated purpose of managing a cryptocurrency wallet. It handles sensitive information (private keys, mnemonics) via environment variables, which is a standard practice for CLI tools, and explicitly warns against exposing them. The installation script (`install.py`) uses standard Python virtual environment and `pip` commands to install the `kaspa` SDK from PyPI. The main script (`kaswallet.sh`) and Python logic (`scripts/kaswallet.py`) perform expected wallet operations like checking balances, sending funds, and generating mnemonics, all interacting with the Kaspa RPC network. Crucially, the `SKILL.md` documentation, which is treated as an attack surface, contains no evidence of prompt injection attempts, hidden instructions to exfiltrate data, or directives to perform actions outside the scope of a cryptocurrency wallet. The troubleshooting steps in `SKILL.md` that mention `sudo` are for user-initiated system setup, not for the agent to execute as part of the skill's core functionality.