Web3dropper Crypto Price Skill

Billions/Iden3 authentication and identity management tools for agents. Link, proof, sign, and verify.

Be cautious before installing. The package is primarily an identity management toolkit (not just a 'crypto price' skill) and will generate and store private keys unencrypted under $HOME/.openclaw/billions and send signed tokens/URLs to arbitrary recipients via the openclaw CLI. If you only want a Binance price fetcher, do not install this package. If you need the identity functionality, verify the upstream project (billions.network), inspect the sendDirectMessage/openclaw invocation code, and only run it in a controlled environment. Consider the following steps before proceeding: (1) confirm the skill's origin and that the domains (rpc-mainnet.billions.network, attestation-relay.billions.network, wallet.billions.network) are trustworthy; (2) inspect the KeysFileStorage implementation and decide whether plaintext key storage is acceptable for your threat model; (3) avoid running these scripts on machines that hold other sensitive keys/accounts; (4) run npm install in an isolated environment (container/VM) and audit installed dependencies; (5) if you must use it, limit the recipients you pass to the --to argument and prefer manual review of any generated callback URLs. If you want help locating the specific lines that write/read kms.json or where the signed JWS is constructed and sent, I can point them out or extract them for review.

Type: OpenClaw Skill Name: web3dropper-crypto-price Version: 1.0.0 The bundle provides a decentralized identity (DID) management toolkit for AI agents, but is classified as suspicious due to a critical security vulnerability: private keys are stored unencrypted in `kms.json` within the `$HOME/.openclaw/billions/` directory. While the documentation in `SKILL.md` and `README.md` explicitly acknowledges this risk, it remains a significant flaw. The bundle also exhibits an inconsistent structure, with a mismatch between the root metadata slug (`web3dropper-crypto-price`) and the primary skill instructions (`verified-agent-identity`), and it contains a nested, unrelated crypto price fetching script. Legitimate domains such as `billions.network` and `privado.id` are used for identity resolution and relaying.