TigerPass — Hardware-Secured Crypto Wallet & Trading Terminal for AI Agents | Hyperliquid Perps, Polymarket Predictions, DEX Swaps, Cross-Chain Bridge, E2E Encrypted Agent-to-Agent Commerce

Crypto wallet and trading terminal for AI agents — trade Hyperliquid perps and spot, bet on Polymarket predictions, swap tokens on 6 EVM chains, bridge USDC...

Things to check before installing/using TigerPass: - Metadata inconsistency: the registry said 'no install spec' but SKILL.md includes Homebrew tap and GitHub build instructions. Ask the publisher to clarify install method and provide signed release binaries. - Verify the source: inspect the Homebrew tap formula and the GitHub repo (TigerPassNet/tigerpass-cli). Confirm release artifacts, checksums, and code review (especially signing/bridge/messaging code) before running brew install or building as root. - Audit the binary: the CLI is given authority to sign EIP-191/EIP-712 messages, do x402 HTTP payments, and execute arbitrary contracts. Ensure the binary is vendor-signed and inspect network endpoints it communicates with (especially any central relayers or discovery endpoints like tigerpass.net). - Test with minimal funds: if you try it, use a brand-new EOA with minimal balance, and avoid granting unlimited ERC-20 allowances (avoid approve --amount max) until you understand the flows. - Disable autonomous/agent-driven trades until you trust it: the skill supports autonomous agent-to-agent commerce and automatic builder-fee approvals — these can cause funds to move without further human confirmation. - Confirm platform requirements: SKILL.md requires Apple Silicon and Secure Enclave; verify your device and whether the CLI enforces/assumes this. - If you cannot audit the code, prefer not to install a custom CLI that holds signing authority. Request signed releases, reproducible builds, or a vetted Homebrew formula before using with real funds. Summary recommendation: the skill's functionality matches its description, but because it grants a CLI broad ability to sign and move funds and the package sources are a custom tap/GitHub repo (plus metadata inconsistencies), proceed only after verifying the release artifacts and auditing the code; treat it as high-risk until proven trustworthy.

Type: OpenClaw Skill Name: tigerpass Version: 0.1.1 TigerPass is a comprehensive crypto trading terminal and wallet for AI agents, providing integration with Hyperliquid, Polymarket, and various EVM chains. It features hardware-secured signing via the Apple Secure Enclave and an agent-to-agent messaging protocol (ACE) for economic negotiations. While the tool incorporates security best practices such as EIP-7702 recovery and owner-verified command execution, it is classified as suspicious due to its high-risk capabilities, including autonomous management of financial assets, execution of arbitrary smart contracts (via `tigerpass exec` in advanced-commands.md), and persistent network communication with a third-party backend (tigerpass.net). These features, while aligned with the stated purpose, grant the agent significant financial and operational power that could be misused if the agent's logic is compromised.