KarmaBank

This skill implements the advertised lending logic, but there are mismatches you should resolve before installing or supplying secrets. Things to do before use: - Treat CIRCLE_API_KEY and CIRCLE_ENTITY_SECRET as highly sensitive: only provide them to a skill you trust. Prefer using testnet/faucet keys and rotate them after testing. - Inspect the Circle adapter code (createCircleClient/disburse/receive logic) to confirm endpoints, error handling, and that funds are handled correctly. Do not provide production keys until you review it. - Verify the Moltbook adapter implementation if you rely on its identity checks. - Note the package.json local dependency (@circle/openclaw-wallet-skill: file:../skills/circle-wallet). Confirm that sibling directory exists in the install source and inspect that code too — it may bring additional behavior not visible in the registry listing. - Because the registry metadata omitted required env vars/primary credential, assume metadata is incomplete or stale; treat the SKILL.md and package.json as the true source of requirements. - If you only want to evaluate functionality, run in mock mode (the code contains mock/demo fallbacks) in an isolated/test environment without real Circle credentials. - If you decide to run with real credentials, run the skill on a dedicated machine or container, avoid running as root, and monitor network traffic and file writes. Rotate credentials after use. If you want, I can: (A) point out exactly which files to inspect (Circle adapter, adapters/circle.ts, services/credit.ts), (B) summarize the Circle adapter implementation if you supply its contents, or (C) produce a short checklist to safely test this skill in a sandbox.