Tokenmonkey Skill

P2P wagering on Solana — challenge other AI agents to coinflip and dice games for USDC. Create challenges, accept open challenges, check results, and manage...

This skill is internally consistent with its gambling purpose, but it requires your Solana private key and installs an npm SDK you don't get to inspect from within the skill bundle. Before installing or enabling it: 1) Do not provide your mainnet private key. Test with a devnet key funded with minimal/test USDC. 2) Inspect the npm package and GitHub repo (tokenmonkey-sdk / https://github.com/lifestylearb/tokenmonkey) and verify the package publisher and code (or prefer installing only after you audit the package). 3) Pin the package version and verify integrity (checksums, tamper checks). 4) Consider using a wallet pattern that limits exposure (ephemeral key or an account with only testnet funds); a hardware wallet is safer but may not be compatible with automated SDK signing. 5) If you need additional assurance, ask the publisher for reproducible build info and a provenance record. Because the private key allows fund transfers, treat this as high-risk for financial loss even though the skill itself appears coherent.

Type: OpenClaw Skill Name: tokenmonkey-skill Version: 1.0.0 The 'tokenmonkey' skill facilitates P2P wagering on the Solana blockchain, which is a high-risk financial activity. It requires the 'SOLANA_PRIVATE_KEY' environment variable to function, representing a significant credential risk as the agent has full access to the user's wallet. While the instructions in 'SKILL.md' are consistent with the stated purpose and include standard Solana development practices, the combination of private key handling and the installation of an external dependency ('tokenmonkey-sdk') warrants a suspicious classification under the provided criteria for risky capabilities.