Cashu Emoji
Analysis
This is a transparent local encoder/decoder for hidden Cashu emoji text; the main safety issue is that decoded Cashu tokens are cash-like bearer assets.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
git clone https://github.com/robwoodgate/cashu-emoji.git cd cashu-emoji npm ci
The skill recommends a user-directed external checkout and npm dependency installation. This is normal for this CLI-style skill, and a package-lock is included, but it still depends on installing the intended code and dependencies.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
A decoded `cashu...` token is a **bearer asset**. Treat it like cash.
The skill explicitly handles Cashu bearer tokens. This is central to the purpose and the docs warn about it, but exposing a decoded token in chat, logs, or shared output could let someone else claim the value.