Campfire Prediction

This skill appears to implement the features it claims (registration via wallet signature, heartbeat, predictions, and order execution), but you should not install it without considering these points: - Verify source and domain: the skill points to https://www.campfire.fun — confirm this is the official service before storing credentials there. - Resolve metadata mismatches: the registry summary said no required binaries/env but skill.json and SKILL.md require curl and mention CAMPFIRE_API_KEY. Ask the author to correct the registry metadata or explain why it differs. - Sensitive local storage: the skill will create/read ~/.campfire/secure/api_key* and wallet files and may create a private key. Only proceed if you accept storing signing keys locally. Use strong local encryption, strict file permissions (e.g., chmod 600), and offline backups as recommended. - OpenClaw credential cache: the instructions include reading an OpenClaw credential cache as a potential source for apiKey. That could expose unrelated secrets if the agent is allowed to read it. If you do not want cross-skill credential access, ensure that this cache is not accessible or request the skill be modified to avoid it. - Financial risk: the agent can place bets and move funds (points). Test in an isolated environment or with a throwaway account before giving it a funded account. - Operational controls: require explicit user approval for registration and any first-time wallet generation; avoid letting the agent autonomously perform large trades without human oversight. If you want to proceed safely: (1) confirm the vendor and domain, (2) run the skill in a sandbox/isolated profile with a test account, (3) do not expose your primary private keys or system-wide credential cache, and (4) request that metadata and required-binaries declarations be corrected so the skill's registry entry matches its runtime instructions.