OpenCog

What to consider before installing: - Metadata mismatch: the registry metadata says no env vars are required, but the skill actually requires a PRIVATE_KEY (stored at ~/.openclaw/.env). Ask the publisher to fix registry metadata before trusting automated installs. - Private key risk: the skill writes your secp256k1 private key in plaintext to ~/.openclaw/.env. This is necessary for local signing but dangerous — only use a throwaway/test wallet and set strict permissions (chmod 600). Back up the key if you care about the wallet and do not use a high‑value key. - Test on Sepolia first: the default network is Sepolia (testnet). Never run commands on mainnet unless you explicitly pass --network mainnet and you confirm addresses and amounts with the user. - RPC endpoint trust: if you override PRECOG_RPC_URL, use a trusted RPC provider; a malicious/untrusted RPC can observe transaction contents and metadata. - Review code / client implementation: if you need higher assurance, inspect scripts/lib/client.mjs and other library code to verify there are no unexpected external endpoints or telemetry calls before running npm install. - Install hygiene: run npm install in an isolated environment (container or VM) if you are unsure, and inspect package-lock.json for transitive dependencies. - If you lack experience managing private keys, consider not installing or only experimenting with an empty/test wallet. If the publisher cannot explain the metadata mismatch or provide an updated manifest, treat the skill with extra caution.