sequence-cli

Manage Sequence smart wallets, projects, API keys, ERC20 transfers, and query blockchain data using the Sequence Builder CLI. Use when user asks about creating wallets, sending tokens, checking balances, managing Sequence projects, or interacting with EVM blockchains.

This skill appears to do what it says, but take these precautions before using it: 1) npx will download and execute code from npm at runtime — if you need higher assurance, audit or install a pinned release from the project's GitHub. 2) Protect private keys: prefer using SEQUENCE_PASSPHRASE to encrypt keys and avoid passing raw private keys on command lines in logs. 3) Verify the CLI's upstream repository (https://github.com/0xsequence/builder-cli) and review the package/version you will run. 4) Run initial tests in an isolated environment (or container) if you're unsure about running third-party code on a production system.

Type: OpenClaw Skill Name: sequence-cli Version: 1.0.0 The skill is classified as suspicious due to its inherent high-risk capabilities, specifically the generation, handling, and storage of cryptographic private keys, and the ability to initiate financial transactions (ERC20 transfers) via the `npx @0xsequence/builder-cli` commands detailed in SKILL.md. While these actions align with the stated purpose of managing Sequence wallets, they represent a significant attack surface. The skill instructs the agent to store encrypted private keys in `~/.sequence-builder/config.json`, which, despite encryption, makes the agent a target for potential misuse if compromised.