Safe Multisig Skill

This skill appears to implement legitimate Safe multisig functionality, but the package metadata understates the runtime requirements. Notable points to consider before installing: - The scripts require SAFE_SIGNER_PRIVATE_KEY (env var) to sign/deploy/propose/approve/execute transactions — providing that key grants the ability to sign transactions that can move funds. Do not provide your main private key. - The skill also uses RPC endpoints (RPC_URL / --rpc-url) and interacts with the Safe Transaction Service (api.safe.global). You should verify or override those endpoints to ones you trust. - The registry entry claims no required env vars; that is incorrect. Treat the skill as requiring a signing credential and an RPC/API configuration. - If you proceed: run the code in an isolated environment, review scripts (especially propose/execute/approve/create-safe), and prefer a low-privilege or ephemeral signer (or a hardware/custodial signing flow) with spending limits. Consider running the scripts in read-only mode first (safe-info, list-pending) and only provide a signer after manual code review. - If you are not comfortable auditing the TypeScript, do not supply private keys to this skill. If you must automate, use a signing service or HSM that enforces policy rather than raw private keys in environment variables.