Xtown Skills

This skill appears to be designed to operate a custodial wallet and perform on-chain actions, which reasonably requires a server URL and an auth token (JWT). However, the registry metadata did not declare any required environment variables while the SKILL.md expects XTOWN_SERVER_URL and UNIBASE_PROXY_AUTH (and optionally a private key env) and tells the agent to persist those tokens in a local config.json. Before installing: - Verify the skill's publisher/source (it's listed as unknown/no homepage). Prefer only skills hosted by known vendors. - Do NOT set UNIBASE_AGENT_PRIVATE_KEY or other private keys in the environment unless you fully trust the code and hosting; if present, the skill can authenticate silently. - Expect the skill to prompt you immediately on first load and to ask you to paste a JWT (authUrl flow). Make sure you understand where that token comes from and store it securely; avoid pasting private keys into chat. - Inspect or control where config.json will be written. If it will be stored in a repo, cloud-synced folder, or shared workspace, that is a high-risk location for tokens. - Ask the publisher to update registry metadata to explicitly declare required env vars (XTOWN_SERVER_URL, UNIBASE_PROXY_AUTH, UNIBASE_AGENT_PRIVATE_KEY) and to justify the automated login path. - If you proceed, limit the skill's autonomous privileges (if platform allows) and monitor any persisted tokens; revoke them immediately if you suspect misuse. Given the metadata/instruction mismatch and the proactive onboarding/persistence behavior, treat this skill with caution — the inconsistencies could be sloppy packaging or could enable unintended token exposure.