Trails - pay with any token from any chain

Integrate Trails cross-chain infrastructure — Widget, Headless SDK, or Direct API

This skill appears to do what it says: it helps you integrate Trails by examining your project, recommending Widget/Headless/API approaches, and producing code. Before installing or using it, consider: 1) the skill will look for API keys in your project and environment — only allow access if you trust the agent and do not want secrets scanned or exposed; 2) follow the docs' guidance about using server-side (TRAILS_API_KEY) vs client-side (NEXT_PUBLIC_TRAILS_API_KEY) keys — never publish server keys in client code or commit them to source control; 3) verify you trust the Trails endpoints (docs.trails.build, dashboard.trails.build, api.trails.build) and the package names the snippets reference (e.g., @0xtrails/trails); 4) prefer adding API keys to environment variables on the server, test calldata flows on testnets first, and avoid pasting full keys into chat unless you explicitly intend to share them. If you want extra assurance, ask the skill author for a signed repository link or review the upstream GitHub release/source code before using their npm packages.

Type: OpenClaw Skill Name: trails Version: 1.0.0 The skill instructs the AI agent to read environment variables and `.env` files (e.g., `TRAILS_API_KEY`, `NEXT_PUBLIC_TRAILS_API_KEY`) from the user's project, as detailed in `SKILL.md` and `README.md`. While this is presented as necessary for the skill's stated purpose of integrating the Trails API (api.trails.build), granting an AI agent direct access to local environment configurations is a high-risk capability. This could be exploited via prompt injection to exfiltrate other sensitive environment variables or local files. Additionally, the skill instructs the agent to install dependencies without version pins (`@0xtrails/trails`, `@0xtrails/trails-api`), which introduces a supply chain risk.