Leanjutsu

This package appears to implement the identity-linking functionality it claims, but review these before installing: - Provenance: confirm the publisher and package identity (the SKILL.md name, README, and _meta.json/registry owner/slug differ). Only proceed if you trust the source and homepage (billions.network). - Key storage: by default private keys will be written to $HOME/.openclaw/billions/kms.json and may be stored unencrypted. If you will store real/private keys, set BILLIONS_NETWORK_MASTER_KMS_KEY to a strong secret (and understand how to manage it), or avoid using real keys on this machine. - CLI key exposure: avoid passing private keys via --key on shells with history; prefer importing keys via secure means or using the KMS encryption feature. - Remote endpoints: the skill sends signed JWS/attestation material to a URL-shortener and to an attestation-relay endpoint (domains under billions.network and resolver.privado.id). Review and accept the privacy implications (these endpoints will see the attestation or the shortener request_uri). If you require on-prem or audited endpoints, adapt the code before use. - Dependency install: the scripts require running 'npm install' which will fetch many packages from npm; audit or pin versions if you need stricter supply-chain guarantees. If you are not comfortable with the above (especially plaintext key storage or sending attestations to remote services), do not install or run the scripts on a machine with valuable keys. If you decide to proceed, set BILLIONS_NETWORK_MASTER_KMS_KEY, review the code yourself (or ask for a vendor attestation), and run in an isolated environment.