Send XCH to Twitter users via Go4Me address lookup. Use when sending Chia (XCH) to someone by their Twitter handle, looking up a Twitter user's XCH address, or tipping someone on Go4Me. Triggers on "send XCH to @user", "tip @user", "lookup @user on go4me", "what's @user's XCH address".

This skill appears to implement Go4Me lookups and to call a local sage-wallet RPC to send XCH — that behavior is consistent with its description. However, before installing or granting it use, check and do the following: (1) Understand that sending requires access to your local wallet TLS client certificate and key (the SKILL.md uses $CERT and $KEY). The skill metadata does not declare these env vars; do not provide them until the skill explicitly documents and justifies how they will be used and protected. (2) Confirm that the agent environment has curl and jq installed; the script depends on them. (3) Verify that the skill will always prompt for an explicit confirmation before submitting any transaction (the docs show a prompt, but verify actual behavior). (4) Audit the skill's behavior locally (source the script and run lookup-only commands) before enabling send capability. (5) Consider running lookups only — do not give wallet credentials to the skill until the author clarifies the required environment variables and how the private credentials are kept local and not exfiltrated. If the author can update the metadata to list required binaries and required env vars (CERT, KEY) and provide clearer info about transaction confirmation and failure modes, this would reduce concern.

Type: OpenClaw Skill Name: go4me Version: 1.0.0 The skill's primary purpose is to resolve Go4Me addresses for Twitter users and facilitate sending Chia (XCH) via a local wallet. The `scripts/go4me-lookup.sh` file makes an external `curl` request to `https://<username>.go4.me/` to retrieve user data, which is essential for its stated functionality. The `SKILL.md` instructs the agent to interact with a local wallet RPC at `https://127.0.0.1:9257/send_xch` using `curl` with `$CERT` and `$KEY` for secure communication, which is an expected and standard practice for cryptocurrency transactions within the OpenClaw environment. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts beyond the skill's clearly defined and necessary operations.