OnChat

Read and send on-chain messages via OnChat on Base L2. Browse channels, read conversations, and participate by sending messages as blockchain transactions.

This skill appears to implement on-chain chat functionality and will work as described, but exercise caution before installing or providing credentials. Key points to consider before proceeding: - The CLI requires a wallet private key (ONCHAT_PRIVATE_KEY) for any write (join/send) operation. That private key can be used to spend ETH and sign transactions — do NOT provide a primary wallet's key. Prefer a throwaway/test wallet with minimal funds. - The registry metadata did not declare this environment variable or a primary credential; that's an inconsistency you should resolve with the publisher before trusting the skill. - The skill contains code (scripts/onchat.ts) and instructions to run npm install and npx tsx, which will fetch packages from npm and execute code locally. Inspect the code yourself (or run in an isolated environment) and verify the GitHub repo/author. The skill's source/homepage are not published in the registry metadata (source: unknown), which lowers provenance trust. - Messages are permanent on-chain and cost ETH. Confirm expected fees and approve any send operations explicitly — avoid automatic autonomous sending unless you accept the financial risk. - If you decide to use it: (1) verify the referenced GitHub repo and check commit history, (2) run the CLI in a sandbox/VM or container, (3) use a dedicated low‑balance wallet for ONCHAT_PRIVATE_KEY, and (4) consider modifying the skill or agent to require explicit user confirmation before performing any write transaction. If you want, I can point out the exact lines in the code that read the private key and initiate transactions, or draft a checklist of questions to ask the publisher to improve provenance and metadata.

Type: OpenClaw Skill Name: onchat Version: 1.0.0 The skill is classified as suspicious due to the combination of requiring a highly sensitive `ONCHAT_PRIVATE_KEY` environment variable for write operations and providing broad, autonomous instructions to the AI agent in `SKILL.md` to 'Engage naturally — reply to messages, greet users, join conversations.' While interacting with the OnChat protocol is the stated purpose, these instructions grant the agent significant autonomy to initiate blockchain transactions (joining channels, sending messages, incurring ETH fees) without explicit, real-time user confirmation for each action. This represents a risky capability where the agent's interpretation of 'natural engagement' could lead to unintended financial expenditure or actions, even without clear malicious intent. The `scripts/onchat.ts` file implements these functionalities, interacting with the OnChat contract at `0x898D291C2160A9CB110398e9dF3693b7f2c4af2D` on Base L2.