Openclaw Skill

Your pet dies if you don't write. Adopt a virtual tamagotchi, journal daily to keep it alive, earn tokens on Base. One command to start — no wallet needed.

This skill appears to do what it says: it creates a local agent wallet (random address), posts that to diarybeast's API, saves a session token and address in ~/.openclaw/workspace/skills/diarybeast, and provides curl examples to interact with the service. Before installing or running: 1) verify you trust the domain (https://dapp.diarybeast.xyz) because the script contacts it and returns a magic link; 2) be aware the session token is stored in plaintext under your home directory (delete it if you stop using the skill); 3) the SKILL.md expects you to run node and use curl — ensure you are comfortable running the included setup.mjs locally; 4) if you are concerned about tracking or remote content, run the script in a disposable environment (container or VM) and inspect setup.mjs (it’s short and readable). The only minor inconsistency: the registry summary lists no required binaries, but the instructions assume node/curl/exec capability — make sure those are available and acceptable before running.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The OpenClaw skill requests the 'exec' tool, which is a high-risk capability, but its usage is transparent and appears benign. The `setup.mjs` script generates a unique agent ID (not a cryptographic wallet) and authenticates with `dapp.diarybeast.xyz`, storing session tokens and addresses within the skill's designated OpenClaw workspace directory. All network interactions are confined to `https://dapp.diarybeast.xyz`. There is no evidence of data exfiltration, malicious execution (e.g., `curl|bash`), persistence mechanisms, or prompt injection attempts against the agent with harmful objectives in `SKILL.md` or `setup.mjs`.