XRPL Token Minting
v1.0.0Create and manage XRPL issued tokens and NFTs, including minting, trust lines, issuing payments, and setting NFT offers with customizable fees and flags.
⭐ 0· 518·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the SKILL.md contents: templates for TrustSet, Payment, NFTokenMint, offers and references to TransferFee/Taxon are appropriate for XRPL token/NFT operations.
Instruction Scope
The instructions provide transaction templates and tell the user to npm install xrpl but do not explain how to sign transactions, manage private keys, choose a rippled node/endpoint, or submit/safely broadcast transactions. This omission can lead to unsafe practices (users pasting secrets) but the instructions do not themselves request unrelated data or system access.
Install Mechanism
No formal install spec in the skill bundle (instruction-only). SKILL.md directs 'npm install xrpl' — expected for a Node.js-based XRPL workflow, but pulling from npm introduces supply-chain risk unless versions and provenance are pinned and verified.
Credentials
The skill declares no required environment variables, credentials, or config paths — this is proportionate to an instruction-only template. However, real use will require private keys or wallet credentials (not declared), which the document does not cover.
Persistence & Privilege
Skill has no 'always' or persistent install behavior and is user-invocable only. It does not request changes to agent/system configuration or other skills' settings.
Assessment
This skill appears to be what it says — transaction templates for XRPL tokens/NFTs — but it leaves out critical operational and safety details. Before using it: (1) Do not paste private keys or secret seeds into chat or the agent; the SKILL.md does not explain how to sign transactions securely. Use a hardware wallet, remote signer, or a secure key-management approach. (2) The instructions ask you to run 'npm install xrpl' — verify and pin the package version, check the package's maintainer and release page, and prefer known release hashes to reduce supply-chain risk. (3) Test everything on XRPL Testnet first and verify which rippled endpoint you will use; the skill does not specify nodes or endpoints. (4) If the agent asks for credentials or to run commands on your machine, be cautious and avoid giving long-lived keys; prefer ephemeral/test credentials. (5) If you need the skill to submit transactions, require explicit instructions in SKILL.md about signing, broadcasting, and safe key handling before installing or invoking it.Like a lobster shell, security has layers — review code before you run it.
latestvk9712f3zz41s4vbgdysggztf6n815bjy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.