Way

Shorthand for /whoareyou — show your verified wayID identity card

This skill is mostly coherent with its goal, but be cautious: SKILL.md requires reading ~/.openclaw/identity/device.json — a file that includes your Ed25519 privateKey — even though the document says only the publicKey is needed. Before installing/use, ask the skill author to (1) update the metadata to declare the required config path, (2) change the file format or provide a helper that exposes only the publicKey (so the agent never reads privateKey), or (3) confirm in code that the privateKey is never read, logged, or transmitted. Also verify the trustworthiness of the way.je endpoints (TLS, correct hostname), and only run this skill in environments where exposing the identity file for read access is acceptable. If you are not comfortable with any possibility of the privateKey being read or transmitted, do not install or invoke the skill.

Type: OpenClaw Skill Name: way Version: 1.0.0 The skill retrieves the agent's public key from a local configuration file (~/.openclaw/identity/device.json) and sends it to an external API (way.je) to fetch an identity card. While the instructions in SKILL.md are explicit about only using the public key and include safety constraints against browser usage or data fabrication, the access to a file containing private keys and the use of external network calls are high-risk capabilities that warrant a suspicious classification under the provided criteria.