nostr-dogechat

This skill appears to implement a Nostr/DogeChat bridge but has several mismatches and privacy-relevant behavior you should understand before installing: - It will generate a private signing key and store it unencrypted at ~/.openclaw/nostr-dogechat/identity.json (rotated after 24h). If you don't want a plaintext secret stored on your machine, do not install/run it as-is. Consider moving storage to a secure keystore or encrypting the file. - SKILL.md says the geohash comes from USER_CONTEXT, but the code reads CLI args; the packaging is inconsistent and the repo omits an install step. Expect to manually install Node and the npm deps (and note package.json is missing 'minimist'). - The skill will open outbound WebSocket connections to public relays (wss://relay.damus.io, wss://nos.lol, wss://relay.dogechat.org) and publish signed events under the generated identity. If you are concerned about network traffic or linking messages to a persistent identity, do not run it until you review/modify the code. Recommendations: inspect and run the code in an isolated environment (or sandbox/VM), add encryption for the identity file or use a dedicated ephemeral identity, update package.json to declare all deps and provide an install step, and confirm you are comfortable with the relay endpoints before enabling autonomous agent invocation.