Use KaspaCom DeFi MCP or CLI to query and transact across KaspaCom DEX, Lending, and LFG Launchpad on IGRA and Kasplex mainnet/testnet. Trigger when the user...

This skill appears functionally consistent with a KaspaCom DeFi CLI/MCP but has two red flags: the runtime tells you to install and run an npm package (which will execute code on your machine) and to supply MCP_WALLET_KEY, yet the registry lists no source/homepage and no required env vars. Before installing: 1) Ask the publisher for the package source (npm page and GitHub repo) and verify checksums and release authenticity. 2) Inspect the package code (or have it reviewed) before running, especially dist/mcp/index.js. 3) Never use your mainnet private key in an env var; use a testnet or ephemeral wallet with minimal funds and consider a hardware wallet or signing proxy. 4) Prefer running the package in an isolated environment (container or VM) until you trust it. 5) Request that the skill metadata be updated to declare MCP_WALLET_KEY as a required credential and include a homepage/source. If the publisher cannot provide verifiable source code or a reputable package listing, avoid installing it on sensitive hosts.

Type: OpenClaw Skill Name: kaspacom-defi-mcp Version: 0.1.0 The skill bundle provides documentation and instructions for the KaspaCom DeFi MCP server, which enables AI agents to interact with decentralized finance protocols (DEX, Lending, Launchpad) on the Kaspa network. The instructions in SKILL.md describe standard installation via NPM (@kaspacom/defi-mcp) and configuration using environment variables for network selection and wallet keys. No malicious code, data exfiltration logic, or prompt injection attempts were identified in the provided files.