Equip, unequip, and inspect Aavegotchi wearables on Base via Bankr submissions.

This skill appears to do exactly what it says: it queries a Base subgraph for your gotchi's current loadout, builds the full 16-slot calldata locally (via lib/equip-lib.js), and submits the transaction payload to Bankr using your BANKR_API_KEY. Before installing/using it: 1) Verify you trust the external endpoints (https://api.bankr.bot and the SUBGRAPH_URL) because transaction submission and subgraph queries go to those services. 2) Be aware the scripts will try to read BANKR_API_KEY from your environment, systemctl --user variables, or bankr config files under ~/.openclaw — if you prefer not to store keys there, set BANKR_API_KEY only in the environment when running. 3) Run npm install in the skill directory if you want Node to resolve the 'viem' dependency before invoking the scripts. 4) Treat your Bankr API key like any wallet/API secret: limit its scope, rotate it if exposed, and test with a non-critical account or dry-run if possible. 5) If you need higher assurance, review the skill's repository on GitHub and confirm the Bankr endpoint and subgraph URL are legitimate and unchanged.

Type: OpenClaw Skill Name: gotchi-equip Version: 1.0.3 The skill bundle provides a legitimate set of tools for managing Aavegotchi NFT wearables on the Base blockchain. It uses the 'viem' library to encode smart contract transactions and interacts with the Bankr API (api.bankr.bot) for transaction submission. The scripts include safety checks, such as fetching the current loadout from a Goldsky subgraph to prevent accidental data loss, and the API key resolution logic is consistent with the requirements of the OpenClaw/Bankr ecosystem. No evidence of malicious intent, data exfiltration, or prompt injection was found.