Stakingverse Lukso

Stake LYX tokens on Stakingverse (LUKSO liquid staking). Use when the user wants to stake LYX, unstake LYX, claim rewards, or check sLYX balance on Stakingve...

This skill appears to be a straightforward LUKSO staking helper but has some red flags you should address before using it: - Do not paste your primary controller private key into environments you don't control. The scripts require a full private key (env variable STAKING_PRIVATE_KEY); that is necessary to sign UP/KeyManager transactions, but it is high-risk. Prefer a hardware wallet, a delegated account with minimal permissions, or a purpose-built staking controller key. - Confirm the Vault and sLYX contract addresses independently (official Stakingverse docs) — the repo hardcodes a vault address; ensure it matches the real contract. - The registry metadata omits required env vars and SKILL.md/README use different names (PRIVATE_KEY vs STAKING_PRIVATE_KEY); verify which env variables the runtime actually uses before running anything. - Install dependencies manually (npm install ethers) in an isolated environment and review the code locally. Test on a non-mainnet/test account or testnet if available before using real funds. - Because the skill will send on-chain transactions, understand gas and approval flows; do not run scripts on machines where the private key might be logged or backed up to external services. If you want to proceed: fix the env var naming (use STAKING_PRIVATE_KEY as the scripts expect), verify addresses, and run with a low-value or test account first. If you cannot validate the origin (source: unknown), be extra cautious — treat it as untrusted code until verified.

Type: OpenClaw Skill Name: stakingverse-lukso Version: 1.0.0 The OpenClaw skill bundle for Stakingverse LUKSO staking is classified as benign. All files, including SKILL.md, README.md, and the JavaScript scripts, clearly outline the skill's purpose: staking, unstaking, and claiming LYX tokens on the LUKSO blockchain. The code uses standard `ethers.js` library calls to interact with specified LUKSO smart contracts and RPC endpoints. While the skill requires a private key for signing transactions (as specified in SKILL.md and used in scripts/claim.js, scripts/stake.js, scripts/unstake-request.js), this is an inherent requirement for on-chain transactions and is transparently declared, not indicative of malicious intent. There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent. The skill adheres to the stated purpose without any high-risk behaviors beyond the necessary interaction with blockchain infrastructure.