Hunazo

This skill appears to be what it claims (a marketplace that needs on‑chain signing), but there are metadata and deployment concerns you should address before enabling it: - Do not place your raw wallet private key in a general-purpose environment variable unless you understand the risk. Prefer a hardware wallet, an external signer, or Coinbase Agentic Wallet (MPC) as suggested in the docs. - The skill metadata marks WALLET_PRIVATE_KEY as required even though the SKILL.md says it's only needed for buying. Expect the platform to prompt for the env var at enable time; decline if you can't provide the key securely. - The metadata lists only curl but the signing flow requires a local x402 client/library; confirm how signing will be performed on your agent host and that the x402 client you use is trusted and installed separately. - Because the agent can invoke the skill autonomously, a private key accessible to the agent could be used to make purchases without additional confirmations. If you enable this skill, restrict when and how it can be invoked (manual invocation or additional prompts), or keep the signing key in a secure signer that requires explicit approval. If you want to proceed, verify the x402 client implementation you will use, prefer delegated/MPC signing, and avoid storing private keys in plain environment variables accessible by the agent runtime.