Bitagent Skill

Launch, buy, and sell tokens on BitAgent bonding curves via CLI. Use when the user wants to create a new agent token, or trade existing agent tokens on BitAgent (BSC Testnet/Mainnet).

This skill implements BitAgent CLI operations but has some red flags you should address before installing: - The code and SKILL.md require a PRIVATE_KEY, but the registry metadata does not declare it. Do not trust the skill with your mainnet/real wallet key until you verify source and behavior. - The script imports dotenv and will read a .env file if present; ensure you do not store other secrets (or the real private key) in repo .env or in OpenClaw config without understanding the risks. - Verify the skill source (README cites a GitHub repo but registry says source unknown). Prefer installing only from a verified repository and review the full scripts/index.ts yourself. - If you want to test functionality, use an ephemeral/test wallet on BSC Testnet and a disposable account. Avoid providing a production private key until you audit the code and dependency tree (package-lock.json includes many transitive packages via @bitagent/sdk). - Consider running the CLI in an isolated environment (container or separate machine) and inspect all stdout/stderr to ensure no secrets are printed or exfiltrated. If the publisher can update the registry metadata to declare PRIVATE_KEY as a required env var and provide a verifiable source URL/repo, that would reduce ambiguity. As-is, treat this skill as 'suspicious' and proceed cautiously.

Type: OpenClaw Skill Name: openclaw-bitagent Version: 0.1.1 The skill bundle is benign. The `SKILL.md` clearly instructs the AI agent to execute a local TypeScript CLI script (`scripts/index.ts`) and return its output, without any prompt injection attempts to deviate from this purpose or hide actions. The `scripts/index.ts` file correctly uses the `PRIVATE_KEY` environment variable for blockchain wallet operations (signing SIWE messages and transactions) and interacts exclusively with the expected `api.bitagent.io` and `testnet-api.bitagent.io` endpoints for authentication and agent management. There is no evidence of data exfiltration to unauthorized destinations, malicious execution, persistence mechanisms, or obfuscation. All dependencies listed in `package.json` and `package-lock.json` are standard and relevant to blockchain interaction and the BitAgent SDK.