Go4Me

Send XCH to Twitter users via Go4Me address lookup. Use when sending Chia (XCH) to someone by their Twitter handle, looking up a Twitter user's XCH address, or tipping someone on Go4Me. Triggers on "send XCH to @user", "tip @user", "lookup @user on go4me", "what's @user's XCH address".

Security Scan

The skill largely does what it claims (lookup Go4Me profiles and call a local sage-wallet RPC to send XCH), but its instructions and files request access to local wallet TLS credentials and runtime tools that are not declared in the skill metadata — this mismatch is concerning and should be resolved before trusting it with funds.

Purpose & Capability

The skill's stated purpose (resolve Go4Me/Twitter handles and send XCH) matches the code and README. Expectation of a local wallet RPC (sage-wallet) is reasonable for sending transactions. However, the skill metadata declares no dependencies or credentials while README/SKILL.md explicitly reference sage-wallet and the send flow, so the declared requirements are incomplete.

Instruction Scope

Runtime instructions and the included script perform network fetches of https://<username>.go4.me/ and parse embedded JSON, which is appropriate for address lookup. The send workflow instructs the agent to POST to https://127.0.0.1:9257/send_xch using client TLS cert/key ($CERT and $KEY) — these environment variables are used in the instructions but are not declared in requires.env. The agent would need access to local wallet credentials to complete transactions; this capability is sensitive and not surfaced in the skill metadata.

Install Mechanism

This is an instruction-only skill with one small shell script; there is no install step or external archive download. That lowers installation risk. Nevertheless, the script depends on system tools (curl, jq) which are not declared as required binaries in the metadata.

Credentials

The skill requires access to a local wallet RPC with client TLS cert and key (referenced as $CERT and $KEY in SKILL.md) to send funds, but the skill metadata lists no required environment variables or primary credential. Requiring wallet certs/keys to send funds would be proportionate to the purpose, but they must be explicitly declared and justified — the omission is a red flag. The script also implicitly requires curl and jq (not declared).

Persistence & Privilege

The skill is not marked always:true and does not request modification of other skills or global agent settings. It can be invoked by the agent (default), which is expected for a send/lookup skill.

What to consider before installing

This skill appears to implement Go4Me lookups and to call a local sage-wallet RPC to send XCH — that behavior is consistent with its description. However, before installing or granting it use, check and do the following: (1) Understand that sending requires access to your local wallet TLS client certificate and key (the SKILL.md uses $CERT and $KEY). The skill metadata does not declare these env vars; do not provide them until the skill explicitly documents and justifies how they will be used and protected. (2) Confirm that the agent environment has curl and jq installed; the script depends on them. (3) Verify that the skill will always prompt for an explicit confirmation before submitting any transaction (the docs show a prompt, but verify actual behavior). (4) Audit the skill's behavior locally (source the script and run lookup-only commands) before enabling send capability. (5) Consider running lookups only — do not give wallet credentials to the skill until the author clarifies the required environment variables and how the private credentials are kept local and not exfiltrated. If the author can update the metadata to list required binaries and required env vars (CERT, KEY) and provide clearer info about transaction confirmation and failure modes, this would reduce concern.

Go4Me Skill

Send XCH to Twitter users by resolving their Go4Me addresses.

Dependencies

• sage-wallet — Required for XCH transactions

Commands

Command	Description
/go4me lookup <user>	Get user's XCH address and profile
/go4me send <user> <amount>	Send XCH to user (amount in XCH or mojos)
/go4me tip <user>	Send 1 mojo tip

Natural Language

• "Send 1 XCH to @hoffmang"
• "Tip @sage_wallet"
• "What's @bramcohen's XCH address?"
• "Look up DracattusDev on Go4Me"

Lookup Script

source scripts/go4me-lookup.sh
go4me_lookup "DracattusDev"  # Returns JSON or exits 1

Workflow

Lookup

1. Strip @ from username if present
2. Run go4me_lookup "<username>"
3. Parse JSON response for xchAddress, fullName, username
4. If exit code 1: user not found on Go4Me

Send

1. Lookup user (as above)
2. If not found, report error
3. Display confirmation:

   Send <amount> to @<username> (<fullName>)?
   Address: <xchAddress>
   [Yes] [No]
   

4. On confirm, call sage-wallet send_xch:

   curl -s --cert $CERT --key $KEY -X POST https://127.0.0.1:9257/send_xch \
     -H "Content-Type: application/json" \
     -d '{"address":"<xchAddress>","amount":"<mojos>","fee":"0","memos":[],"auto_submit":true}'
   

5. Report transaction result

Tip

Same as send with amount = 1 mojo.

Amount Conversion

Input	Mojos
1 (no unit)	1 mojo
1 mojo	1
0.001 XCH	1000000000
1 XCH	1000000000000

Parse amount: if contains "XCH", multiply by 10^12. Default unit is mojos for small numbers, XCH for decimals.

Error Handling

Condition	Response
User not on Go4Me	"User @{username} not found on Go4Me"
Invalid address	"Invalid XCH address returned from Go4Me"
Insufficient balance	"Insufficient balance for this transaction"
Network error	"Failed to connect to Go4Me"

Data Available

Field	Example
username	DracattusDev
fullName	🌱Drac 🍊
xchAddress	xch1rvgc3naytvzhv4lxhzphrdr2fzj2ka340tdj8fflt4872t2wqveq9lwz7t
description	Bio text
avatarUrl	Profile image URL
totalBadgeScore	220