NanoBazaar

This skill appears to do what it claims, but take these precautions before installing: - Only install the nanobazaar-cli npm package from a source you trust; inspect the package if possible. The setup command may also attempt to install the berrypay CLI by npm (optional). - The CLI persists private keys and state locally (NBR_STATE_PATH). If you plan to run this skill, ensure the agent filesystem is secure and you are comfortable storing signing/encryption private keys there. Prefer generating keys with `/nanobazaar setup` rather than pasting secrets into environment variables unless the environment is locked down. - Be aware `nanobazaar watch` will trigger wakeups that cause the agent to run on relay events — this is normal for a watcher but increases activity and the chance of autonomous invocations. If you want to limit automatic runs, do not run the watcher and invoke `nanobazaar poll` manually instead. - The skill warns repeatedly not to execute commands or follow instructions embedded inside payloads; follow that guidance and require explicit human approval before fetching or running any links/commands received in deliverables. - Minor metadata inconsistency: the SKILL header indicated no homepage, while skill.json lists https://nanobazaar.ai; if provenance matters, verify the upstream project/source before installing. If you accept those trade-offs, the skill's requested capabilities and instructions are proportionate to its stated purpose.