Towns Protocol Skills

Use when building Towns Protocol bots - covers SDK initialization, slash commands, message handlers, reactions, interactive forms, blockchain operations, and deployment. Triggers: "towns bot", "makeTownsBot", "onSlashCommand", "onMessage", "sendInteractionRequest", "webhook", "bot deployment", "@towns-protocol/bot"

This skill's instructions look like a legitimate Towns Protocol bot SDK reference, but take these precautions before installing or running it: - Verify provenance: the skill has no homepage and an unknown source. Prefer an official repo or NPM package for @towns-protocol/bot and install only from trusted origins. - Secrets: the SKILL.md requires APP_PRIVATE_DATA and JWT_SECRET. Treat these as sensitive: store them in a secrets manager, do not paste them into public places, and rotate them if exposed. Confirm APP_PRIVATE_DATA was issued by the official Towns developer portal. - Minimize RPC key scope: use a dedicated RPC key (BASE_RPC_URL) with minimal privileges and rate limits. For read-only operations use a read-only key when possible; keep the funded gas wallet separate and funded with minimal ETH required for operations. - Isolate runtime: run the bot in a sandboxed environment (separate VM/container) and avoid exposing debug endpoints in production. The health endpoint prints the gas wallet address — consider removing or restricting access to that endpoint. - Audit logging and attachments: the docs suggest logging message content and reading local files for attachments; ensure logs do not capture PII and attachments are validated before upload. - Confirm declared requirements: the registry metadata claims no env vars but the docs do — ask the publisher to correct metadata or provide the official package source. If you cannot verify the publisher, do not provide secrets to the skill. - Code review: because this is instruction-only here, request or review the actual @towns-protocol/bot SDK source and any bot code you intend to run. Pin package versions and audit dependencies. If you cannot confirm the skill's origin or reconcile the missing metadata, treat it as untrusted and avoid supplying APP_PRIVATE_DATA and JWT_SECRET to any code derived from this skill.

Type: OpenClaw Skill Name: towns-protocol Version: 2.0.0 The skill bundle provides comprehensive documentation and code examples for building a Towns Protocol bot, covering SDK usage, blockchain operations, messaging, interactive components, debugging, and deployment. It consistently promotes good security practices, such as verifying blockchain transactions on-chain before granting access. All code snippets and instructions are aligned with the stated purpose, using standard libraries and tools without any evidence of data exfiltration, malicious execution, persistence, or harmful prompt injection attempts against the agent. The use of environment variables is for bot configuration, and file access examples (e.g., `readFileSync` in `references/MESSAGING.md`) are for legitimate bot functionalities like sending attachments, not for arbitrary file access or exfiltration.