XLMTools

Live data and actions for Stellar (XLM, Soroban, DEX, USDC), plus crypto prices, stock quotes, weather, domain checks, web search, deep research, screenshots...

This skill appears to do what it says (live Stellar data and actions) but it carries a few practical risks you should understand before installing: (1) it suggests installing npm packages (@xlmtools/cli, @xlmtools/mcp) which will run third‑party code on your machine — verify the package source and review code if possible; (2) on first run it auto-generates and stores a Stellar wallet (private keys) at ~/.xlmtools/config.json and auto-funds it via friendbot — that file is sensitive and the SKILL.md does not explain encryption or key management; (3) it will call external URLs (api.xlmtools.com) and may perform micropayments automatically for low-cost operations marked 'mention' without pausing; (4) there is no published homepage or source repository listed in the registry metadata, so provenance is limited. Before proceeding, ask the publisher for: a link to the source repo or package on npm, details about how the wallet file is protected, and clear confirmation about which network (testnet vs mainnet) and which payment tokens are used. If you install, prefer running the CLI in a contained environment (isolated account or VM), inspect the npm package contents, and treat any created wallet keys as sensitive (move/store them securely or manage your own keys instead of letting the CLI auto-generate them).

Type: OpenClaw Skill Name: xlmtools Version: 1.0.0 The xlmtools skill bundle provides instructions for an agent to use a suite of tools for Stellar blockchain interactions and web tasks (search, scraping, research). It requires high-risk capabilities including shell access (Bash), network access, and local filesystem access to manage a Stellar wallet at `~/.xlmtools/config.json`. While the `SKILL.md` file contains detailed instructions for cost transparency and user confirmation regarding its USDC micropayment system, the requirement to install external global NPM packages (`@xlmtools/cli`) and the broad functional scope (including screenshotting and scraping) warrant a suspicious classification under the provided criteria, despite the lack of clear malicious intent. IOCs include the domain `api.xlmtools.com` and the NPM package `@xlmtools/cli`.