Signet

This skill appears to do what it says (estimate/list/post Signet spotlight ads) but has a few important caveats you should consider before installing or invoking it: - Private key handling: Posting requires signing with a wallet private key (PRIVATE_KEY or --private-key). Never store your main wallet private key in a skill environment. Use a dedicated, funded test wallet or hardware wallet / offline signing where possible. - Remote code execution via npx: The SKILL.md instructs use of npx @signet-base/cli. npx will fetch and run code from npm at runtime — verify the package name, publisher, and source repository before running. Inspect the package source (or install into an isolated environment) and prefer pinned, audited releases. - Unknown API host: The API base (signet.sebayaki.com) has no homepage listed. Treat network endpoints as untrusted until you verify them. Use the --simulate flag first to avoid committing funds and inspect the request/response traffic if possible. - Metadata mismatch: The skill metadata declares no required env vars, but the instructions reference PRIVATE_KEY. Ask the skill author to clarify required credentials and to declare them in metadata; prefer skills that explicitly state required scopes and secrets. - Safer alternatives: prefer offline or delegated signing (generate a payment payload and sign it locally with a wallet you control), use a dedicated small-balance wallet for testing, or review the @signet-base/cli source before use. If you proceed: test with --simulate, use a throwaway wallet with minimal balance, inspect network requests, and verify the npm package and API domain provenance. If you cannot verify those, do not provide real private keys or run commands that submit payments.