Clawlett

Key points to review before installing or running this skill: - Missing metadata vs real requirements: The skill metadata claims no required binaries or config files, but the code needs Node (and npm), git for migrations, a config directory with wallet.json, and a local agent private key file (agent.pk). Don't run the scripts until you can satisfy and control these requirements. - Protect the agent private key: The skill generates/reads agent.pk and uses it to sign transactions and authenticate to the Trenches API. Only run this in an environment you control; if you let the agent generate a key, ensure you retain custody and understand the deploy/transfer flow before funding anything. - Confirm explicit-execution behavior: SKILL.md states the agent must never execute on-chain transactions without explicit user confirmation. Verify in practice (in a safe test environment) that the runtime enforces this and that the agent doesn't auto-run migration scripts or git checkouts. - Audit external endpoints and hardcoded addresses: The scripts call CoW (api.cow.fi), Kyber (aggregator-api.kyberswap.com), DexScreener, and Trenches (trenches.bid) and hardcode a partner fee recipient (0xCB52B32D...). Review those endpoints and the partner fee behavior to ensure you accept the fees and trust the services. - Run in isolation first: If you want to test, run the code locally in an isolated VM or container, inspect the code, run npm install from package.json, and manually step through initialize.js without funding or broadcasting transactions. - Consider additional declarations: Ask the publisher to update the skill metadata to list required binaries (node, git), config paths (config/wallet.json, agent.pk), and any required env vars (BASE_RPC_URL, WALLET_CONFIG_DIR, TRENCHES_API_URL). That makes the security posture auditable. If you cannot or will not audit the code and control the agent key and execution environment, do not use this skill with real funds.