Jubilee Skill, By Jubilee Labs

Manage and grow your agent's treasury across Base, Solana, and Ethereum using Jubilee Protocol vaults for sustainable yield and principled spending.

Do not provide your private keys or place them at the documented wallet path. Before installing or running this skill: (1) Ask the publisher for the actual implementation code or an official package (the SKILL.md references npm scripts and lib/*.js but none are included). (2) Require the skill to declare required environment variables and config paths in metadata (RPC endpoints, signer method), and to explain how signing is performed securely (prefer external signer/hardware wallet or a scoped signing service instead of a raw privateKey file). (3) If you test, use a new wallet funded only with testnet tokens and a read‑only/watch wallet or a signer that requires manual approval for each transaction. (4) Verify the skill author's identity and provenance (unknown homepage and single owner id here). (5) Ask for code review or provide the skill only through an official, auditable release before entrusting any real funds.

Type: OpenClaw Skill Name: openclaw-skill-jubilee Version: 0.1.0 This skill is classified as suspicious due to its inherent high-risk capabilities, which, while plausibly needed for its stated purpose of treasury management, present significant attack surfaces. Specifically, the `donate-yield` command allows transferring funds to arbitrary recipient addresses, posing a direct financial risk if exploited via prompt injection. Additionally, the `war-room` command's ability to analyze local git activity, including uncommitted changes, could lead to sensitive information leakage if the agent operates in a repository containing secrets. The skill also requires direct access to private keys for blockchain transactions, which is a critical security concern.