Whoareyou

Show your verified wayID identity card when a user asks who you are

This skill appears to do what it says, but exercise caution before installing or enabling it: 1) Source provenance: there is no homepage or code to inspect — verify the publisher (owner ID) and trustworthiness of way.je before use. 2) Private key risk: the file you must read (~/.openclaw/identity/device.json) contains a privateKey field; ensure the agent implementation only extracts the publicKey, does not print/log the full file, and never transmits the privateKey. 3) Network calls: confirm the agent uses HTTPS with proper certificate validation and only calls way.je endpoints as documented. 4) Testing: run the skill in a controlled environment first (or with a test identity) to confirm it cannot exfiltrate secrets. 5) Safer alternatives: if possible, expose a minimal API or OS-level accessor that returns only the public key or a fingerprint instead of giving file access to a blob containing a private key. If you cannot verify the implementation or origin, do not install/enabled the skill.

Type: OpenClaw Skill Name: whoareyou Version: 1.0.0 The skill requires the agent to read '~/.openclaw/identity/device.json', a file containing both public and private keys, and then perform external network requests to 'way.je'. While the instructions in 'SKILL.md' state that only the 'publicKey' is needed, the proximity of the 'privateKey' in the same file and the transmission of data to an external API represent a high-risk pattern for potential secret leakage or accidental exposure.