Interact with Mamo DeFi yield strategies on Base (Moonwell). Deposit/withdraw USDC, cbBTC, MAMO, or ETH into automated yield strategies. Check APY rates and account status.

What to consider before installing/use: - Metadata mismatch: the registry lists no required env vars but the CLI requires MAMO_WALLET_KEY (your wallet private key). That omission is an integrity/visibility problem — treat the private key requirement as real even if not declared. Do not set your main/private key in the environment for this skill. - Use a dedicated hot wallet: if you try the tool, create a separate wallet with limited funds and use that key only. Never expose your main wallet private key in environment variables or committed files. - Prefer ephemeral signing: if possible, avoid placing a raw private key in plaintext. Use a hardware signer, a JSON-RPC signer with restricted permissions, or an ephemeral test key. - Review endpoints & addresses: the code posts SIWE messages and other requests to mamo-queues.moonwell.workers.dev and mamo-indexer.moonwell.workers.dev and interacts with on-chain contract addresses included in references. Verify these endpoints and contract addresses independently (official docs/repos) before trusting them. - Be aware of persistence: the CLI writes ~/.config/mamo/auth.json and strategies.json. Inspect these files if you run the tool to ensure no sensitive secrets are stored accidentally. - Autonomy risk: the platform allows the agent to invoke skills autonomously. If you set MAMO_WALLET_KEY in the agent environment, an autonomous agent could sign/send transactions without explicit per-transaction confirmation. If you must provide a key, prefer manual invocation or deny autonomous invocation for this skill. - Audit before use: the repository contains many source files implementing blockchain calls; if you plan to use real funds, have someone you trust audit the code (or run the official published mamo-cli from Moonwell's official repo/registry rather than an unknown registry copy). - Dry-run/testing: use the CLI's dry-run mode and test on a non-mainnet environment (or with tiny amounts) first. Don't store the private key in a repository or shared machine account. If you want, I can list precise code locations where the private key is read, where network calls happen, and where files are written so you (or an auditor) can inspect them quickly.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 25 The OpenClaw AgentSkills skill bundle for Mamo CLI is benign. The `SKILL.md` file provides clear, non-manipulative instructions for the AI agent and the user, including security best practices for handling private keys. The JavaScript/TypeScript code (`scripts/mamo.mjs`, `src/**/*.ts`) performs legitimate DeFi operations on the Base chain using the `viem` library, such as creating strategies, depositing/withdrawing tokens, and fetching account status/APY rates. Network communication is restricted to Moonwell-controlled API endpoints (`https://mamo-queues.moonwell.workers.dev`, `https://mamo-indexer.moonwell.workers.dev`) and CoinGecko for price data (`https://api.coingecko.com`), all of which are consistent with the stated purpose. Private keys are read from environment variables (`MAMO_WALLET_KEY`) as expected for a crypto CLI, and local state is stored in `~/.config/mamo/`.