SushiSwap SDK

TypeScript SDK for interacting with the SushiSwap Aggregator and related primitives. This SDK is a typed wrapper over the SushiSwap API, providing ergonomic helpers for token amounts, prices, quotes, and swap transaction generation. USE THIS SKILL WHEN: - Building TypeScript or JavaScript applications - You want strongly typed token, amount, and fraction primitives - You need to request swap quotes or executable swap transactions via code - You want safer arithmetic, formatting, and comparisons without floating point errors - You prefer SDK-based integration over raw HTTP requests

This skill appears to be a legitimate SDK wrapper for SushiSwap, but there are important mismatches and provenance gaps you should address before installing or using it: - The reference examples show reading process.env.PRIVATE_KEY to sign and send transactions, yet the skill metadata does not declare any required environment variables. Do not provide your private key to this skill (or to an agent) unless you fully trust the source and understand exactly when and how it will be used. - The skill source and homepage are unknown. Verify the package author and locate the official repository or npm package named 'sushi' before installing — typosquatting and fake packages are common on registries. - If you need to execute swaps, prefer signing transactions offline or with a hardware wallet / ephemeral key that has minimal funds and limited permissions. Never store high-value keys in plain process.env for untrusted agents. - Ask the skill author to: (1) declare required env vars (e.g., PRIVATE_KEY) in metadata, (2) document exactly how referrer is used and whether any revenue/affiliate behavior occurs, and (3) provide a source repository or official homepage so you can audit the package code. If you can't verify provenance or the author cannot clarify the env/credential handling, treat this skill as untrusted and avoid giving it signing keys or broad access.

Type: OpenClaw Skill Name: sushiswap-sdk Version: 0.1.0 The skill bundle is classified as suspicious due to the presence of code in `references/REFERENCE.md` that demonstrates reading `process.env.PRIVATE_KEY` and using it to sign and send blockchain transactions. While presented as an example for developers on how to use the SDK, this instruction, if interpreted and executed by an AI agent, could lead to the agent accessing and utilizing a highly sensitive credential from its environment for transaction execution, representing a significant security risk without clear malicious intent of exfiltration.