Clawdit-lender

Before installing or enabling this skill: - Verify the service/operator. The registration endpoint is hosted at https://clawdit.up.railway.app (third-party). Ask for the project's source code, maintainer identity, and security/audit information for that endpoint. Do not trust a random Railway host without vetting. - Clarify what credentials the API returns. Specifically ask: Does registration return a private key or a signing token? Where are keys stored? Does the agent ever transmit private keys to the remote service? Request a secure, auditable key management design (e.g., keys generated and kept client-side, or use of ephemeral signing proxies with clear revocation). - Do not fund the wallet with real/mainnet funds until you understand and can revoke access. Test only with small amounts on testnets, and confirm how to freeze or recover funds. - Require explicit limits and human approvals for transactions (e.g., maximum single-transaction amount, daily total, or operator confirmation) rather than fully autonomous indefinite operation. - Ask for logging and audit trails: which endpoints the agent calls, when transactions occur, and how reputation updates are recorded and can be disputed. - Resolve the minor metadata mismatch: SKILL.md lists curl/jq as required binaries but registry metadata lists none — confirm the runtime environment has the listed tools. If the operator cannot answer these questions, treat the skill as high-risk and avoid funding or enabling autonomous lending.