Xflows Bridge

Cross-chain bridge operations using the xflows CLI (Wanchain XFlows). Use when the user wants to: (1) create or manage crypto wallets for cross-chain use, (2...

This skill is a documentation wrapper for the xflows CLI and is coherent with its stated purpose, but it operates on sensitive private keys and wallet files. Before installing or using it: (1) verify the xflows npm package provenance (official GitHub repo and trusted npm publisher) before running `npm install -g xflows`, (2) do not import or reveal real private keys to the skill unless you fully trust the CLI and environment—prefer encrypted wallets or hardware wallets, (3) test flows with dry-run and very small amounts first, (4) be cautious with `wallet show` (it prints private keys) and with commands using `--private-key`, (5) check ~/.xflows/wallets/ if you use the CLI to understand where keys are stored, and (6) request that the skill metadata be updated to declare the xflows binary dependency so the dependency is explicit. If you need higher assurance, require explicit human confirmation before any send/transfer command and/or disable autonomous invocation for this skill.

Type: OpenClaw Skill Name: xflows-bridge-skills Version: 0.2.0 The skill provides an AI agent with high-risk capabilities, including the ability to display cryptocurrency private keys (xflows wallet show) and execute financial transactions (xflows send, xflows transfer). While these functions are aligned with the stated purpose of managing the Wanchain XFlows bridge, they create a significant attack surface where prompt injection could lead to the exfiltration of private keys or unauthorized movement of funds. The skill relies on the external 'xflows' CLI, and its core workflow involves handling sensitive wallet data directly within the agent's execution environment (SKILL.md, references/commands.md).