Near Multi Account Manager

Secure multi-account management for NEAR Protocol with encrypted credential storage, account switching, and balance aggregation.

What to consider before installing: - Do not install or run this skill in a production environment until you review and remove the unrelated scripts. Several included JS files contain a hard-coded bearer token and make outgoing requests to market.near.ai — behavior not described in the documentation. - If you want the core wallet functionality: inspect src/index.js and the package locally, remove or quarantine any deliverable/*.js scripts that call external hosts, and confirm no other hidden scripts exist. - Rotate any exposed keys if you or your org have used them (the repo contains a visible token that may be valid). Assume any hard-coded secret in a package is compromised. - Replace the shipped default encryption key by setting NEAR_SKILL_KEY to a strong value before adding any private keys; do not rely on the default key. - Consider running the skill in an isolated environment (air-gapped or restricted egress) until you are confident no unexpected network calls will occur. - Prefer skills with an identified upstream source/homepage and no embedded secrets. If in doubt, request the author to remove deliverable submission scripts and re-release a clean package.

Type: OpenClaw Skill Name: near-multi-account-manager Version: 1.0.2 The core skill functionality for NEAR multi-account management appears benign. However, the bundle includes several ancillary JavaScript files (e.g., `check_deliverable_endpoint.js`, `check_job.js`, `submit_deliverable.js`, `submit_deliverable_submit.js`, `update_deliverable.js`) that contain a hardcoded live API key (`sk_live_iOQS6NKYgLCf8sAcIsjeNpIvsN9ml7fK6CVrfIyPIVs`) and make network requests to an external domain (`market.near.ai`). While these scripts are likely for developer-side job submission/testing and not intended to harm the end-user, the inclusion of a live secret key and external network communication outside the skill's stated purpose is a significant security oversight and a risky capability.