Towns Protocol Skills

This skill's instructions look like a legitimate Towns Protocol bot SDK reference, but take these precautions before installing or running it: - Verify provenance: the skill has no homepage and an unknown source. Prefer an official repo or NPM package for @towns-protocol/bot and install only from trusted origins. - Secrets: the SKILL.md requires APP_PRIVATE_DATA and JWT_SECRET. Treat these as sensitive: store them in a secrets manager, do not paste them into public places, and rotate them if exposed. Confirm APP_PRIVATE_DATA was issued by the official Towns developer portal. - Minimize RPC key scope: use a dedicated RPC key (BASE_RPC_URL) with minimal privileges and rate limits. For read-only operations use a read-only key when possible; keep the funded gas wallet separate and funded with minimal ETH required for operations. - Isolate runtime: run the bot in a sandboxed environment (separate VM/container) and avoid exposing debug endpoints in production. The health endpoint prints the gas wallet address — consider removing or restricting access to that endpoint. - Audit logging and attachments: the docs suggest logging message content and reading local files for attachments; ensure logs do not capture PII and attachments are validated before upload. - Confirm declared requirements: the registry metadata claims no env vars but the docs do — ask the publisher to correct metadata or provide the official package source. If you cannot verify the publisher, do not provide secrets to the skill. - Code review: because this is instruction-only here, request or review the actual @towns-protocol/bot SDK source and any bot code you intend to run. Pin package versions and audit dependencies. If you cannot confirm the skill's origin or reconcile the missing metadata, treat it as untrusted and avoid supplying APP_PRIVATE_DATA and JWT_SECRET to any code derived from this skill.