wachaimandates

Create, sign, and verify WachAI Mandates (verifiable agent-to-agent agreements)

This skill appears internally consistent, but before installing and using it: 1) Verify the npm package and its source (review the GitHub repo / package contents) before running npm install -g. 2) Protect private keys: avoid exporting WACHAI_PRIVATE_KEY on shared systems; prefer the local wallet file and secure filesystem permissions. 3) Be aware the CLI will persist wallet.json and received XMTP messages to disk (default ~/.wachai or whatever you set in WACHAI_STORAGE_DIR) — choose a secure location. 4) XMTP receive will open a network/listener pattern and will store incoming messages; only accept mandates from trusted peers. 5) If you want to allow autonomous agent use, make sure you trust the skill and review the CLI behavior; the skill is not always-enabled by default. If you are unsure, inspect the published npm package source code before installing.

Type: OpenClaw Skill Name: wachai-mandates Version: 1.0.2 The skill bundle provides instructions for installing and using the `wachai` CLI tool, which facilitates creating, signing, and verifying verifiable agent-to-agent agreements (mandates) and exchanging them via XMTP. All commands and instructions, including `npm install -g @quillai-network/wachai`, `wachai wallet init`, and `wachai xmtp send/receive`, are directly aligned with the stated purpose of the skill. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation within the provided files. The skill's operations, such as handling cryptographic keys and network communication, are inherent to its described functionality and do not indicate malicious intent.