Stellar Agent Walletv1.7.0

This skill is reasonably coherent as a Stellar agent wallet, but proceed only after you understand the following: - Secrets: The wallet expects a secret key file (default .stellar-secret) and will fall back to .env.prod/.env or STELLAR_SECRET-style env vars if the file is missing. The registry metadata did not declare required credentials — make sure you provide the secret in the intended file and not expose it in environment variables unless you accept that risk. - File writes: The skill can write an autopay directive into your secret file (writeAutopayCeiling). If you prefer the plugin not to modify your secret file, do not use autopay or inspect/modify code to disable that behavior. - Remote endpoints: The client code calls hardcoded endpoints (apiserver.mpprouter.dev and intentapiv4.rozo.ai). Those are legitimate for the advertised features (MPP Router, Rozo), but you should confirm you trust those services and review network activity if you require a different provider (some modules do not expose an override and require editing source to change the base URL). - What to audit before trusting/installing: review scripts/src/stellar-signer.ts and the sign/send code paths to ensure no raw private key is ever transmitted (only signatures/transaction XDRs should be). Confirm you are comfortable with the skill reading .env files in the same directory and with it modifying the secret file. Test thoroughly on testnet before using mainnet funds. - Operational note: dependencies are declared in package.json but there is no install spec; ensure Node >=18 and that dependency installation is handled in your environment. If you want, I can (a) list the exact files and lines where secrets are read/written, (b) inspect stellar-signer.ts to confirm whether the raw secret is ever transmitted, or (c) suggest minimal code edits to avoid writing to the secret file or to make the Rozo/MPP endpoints configurable.