Nla Create

Create a Natural Language Agreement escrow on-chain. Use when the user wants to lock ERC20 tokens in an escrow with a natural language demand that an AI orac...

This skill appears to do what it claims (help create an NLA escrow) but requires you to sign blockchain transactions, which means exposing an Ethereum private key or using a local wallet. Before installing/using: 1) Do NOT paste your main private key into the chat—use a local wallet or hardware wallet. 2) Prefer connecting/signing locally with your wallet or use an ephemeral/test wallet on a testnet (anvil/sepolia) for initial trials. 3) Verify the authenticity of the 'nla' npm package and prefer installing it manually in your environment rather than relying on the agent to install anything. 4) If you must provide a private key to commands, prefer supplying it via a local terminal flag or environment variable controlled by you (not in chat), and never store or transmit it to unknown endpoints. 5) Confirm the oracle and token addresses before escrowing tokens and understand that the demand text and arbitration parameters are encoded on-chain and publicly visible. If you are not comfortable managing private keys or trusting the CLI/oracle, do not proceed.

Type: OpenClaw Skill Name: nla-create Version: 1.0.0 The skill bundle facilitates blockchain escrow creation using the `nla` CLI, which requires high-risk capabilities including shell command execution (`Bash(nla:*)`) and the handling of sensitive Ethereum private keys. While these actions are plausibly necessary for the stated purpose in `SKILL.md`, the instructions specifically guide the agent to handle or set private keys via CLI arguments or environment variables, which is a significant security risk. No clear evidence of intentional malice or data exfiltration was found, but the reliance on a global NPM package (`nla`) and credential handling warrants a suspicious classification under the provided criteria.