AWP Wallet Skill

This skill appears to be a legitimate EVM wallet CLI, but it makes persistent changes and handles secrets — so proceed only if you trust the source and have reviewed the code, especially the keystore/session code. Things to consider before installing: - The installer will clone from GitHub, run npm install, add ~/.local/bin to your PATH (it may append to your shell rc) and create $HOME/.openclaw-wallet where keys/sessions/config live. If you don't want those changes, do not install. - The CLI exposes powerful operations: export (mnemonic), sign-message, unlock (session tokens) and can send transactions. If an agent is tricked into running export or unlock with full scope, it could leak your seed or sign transactions. Never provide your mnemonic/private key to an untrusted agent. - The package will read environment variables for gasless providers and RPC templates (PIMLICO_API_KEY, ALCHEMY_API_KEY, STACKUP_API_KEY and arbitrary names referenced in your config). Those env vars are not declared as required in the registry metadata — expect runtime errors or hidden dependencies if config references missing variables. - The installer may attempt sudo npm link if normal linking fails — be cautious about running scripts that invoke sudo. - If you plan to use this skill: (1) review scripts/lib/keystore.js and session.js to understand how secrets are stored and exported, (2) verify the upstream GitHub repo and the npm package checksum, (3) consider running in an isolated environment or throwaway account, and (4) avoid using the 'export' or 'unlock --scope full' commands unless you explicitly trust the runtime and agent. Given the combination of persistent file writes, shell rc modifications, and undeclared environment dependencies, I recommend manual code review (especially keystore/session) before installing; if you cannot review, treat this skill as risky and avoid installing it on machines holding real funds.