Trustra Escrow

Escrow as a Service for AI agents. Create trustless USDC escrow transactions on Solana.

The package is internally consistent with a Trustra escrow client, but you must trust the Trustra service before storing funds. Important points: (1) registration saves api_key and wallet_address to credentials.json in the skill folder — protect that file and don't commit it. (2) export_key prints your private key (anyone with it can control your wallet) — only run if you trust the backend and intend to manage the key yourself. (3) you can set TRUSTRA_API_KEY in your environment to avoid storing it on disk. (4) verify the API domain (https://api.trustra.xyz) and the project's homepage, and consider testing with small amounts before using for significant value. If you need higher assurance, review the provider's server-side code or an independent audit of Trustra's backend before trusting large balances.

Type: OpenClaw Skill Name: trustra-escrow Version: 1.0.0 The skill is classified as suspicious due to two main reasons. First, the `scripts/export_key.py` script explicitly prints a private key to standard output. While this is an intended 'export' feature and includes a warning, exposing a private key in this manner is a high-risk capability that could lead to compromise if the output is logged or mishandled. Second, the `scripts/config.py` file uses `shutil.rmtree` to remove the `__pycache__` directory. Although this is a targeted cleanup operation within the skill's own directory and not inherently malicious, `shutil.rmtree` is a powerful command that represents a risky file system operation. There is no evidence of intentional malicious behavior like unauthorized data exfiltration or prompt injection attempts against the agent.