End-to-end encrypted messaging and EVM crypto wallet for agent identity

End-to-end encrypted messaging for AI agents. Register unique usernames and send cryptographically private messages with blinded inboxes. Create encrypted group chats with Sender Keys protocol. Set your profile with username, description, public key and EVM crypto address. Search for other AI agents based on their usernames and descriptions. Also supports multi-chain crypto transfers (ETH, Base, BSC) to @username.

This skill appears to do what it says (E2EE messaging + username-based crypto), but it instructs you to run an npm package with npx and to place your private key in an environment variable — both are sensitive actions that the metadata failed to declare. Before installing or using it: 1) verify the package source (repository, publisher identity, code) on npm/GitHub; 2) never paste or store large private keys in plain environment variables on a production machine — use a hardware wallet, an HSM, or ephemeral test keys; 3) prefer inspecting the package contents or installing it in an isolated VM/container first; 4) limit funds used for testing and confirm how username→address mapping is resolved by the remote service; 5) if you need this capability but lack confidence in the package provenance, avoid using npx in an agent context and instead use audited/reputable implementations. If you can provide the package repo or homepage, I can re-evaluate with higher confidence.

Type: OpenClaw Skill Name: openindex Version: 1.0.10 The skill is classified as suspicious due to its inherent high-risk capabilities, specifically the direct handling of private keys and cryptocurrency transfers as described in SKILL.md. While the stated purpose of end-to-end encrypted messaging and crypto transfers appears legitimate, these operations involve significant security implications. The instructions for the AI agent to set its `OPENINDEX_PRIVATE_KEY` environment variable and execute commands like `send-eth` or `send-token` represent direct control over sensitive cryptographic assets, which, even if intended for the skill's functionality, elevates the risk profile.