SilkyWay

This skill appears to do what it says (a Solana payments CLI) and uses an expected npm install path, but review these before installing or using with real funds: - Private keys are stored locally and unencrypted in ~/.config/silkyway/config.json (bs58). Protect that file, avoid syncing it to cloud backups, and restrict filesystem permissions. - There is an undocumented environment override: setting SILK_API_URL will redirect the CLI to any server. Only set this if you trust the server. A malicious endpoint could respond with crafted payloads or accept signed transactions; the private key itself still stays local, but changing the endpoint can alter transaction flows. - Verify the npm package origin (publisher, npm page, GitHub repo and releases) before installing globally. Confirm the published package includes the expected dist/cli binary and matches the source repository. - On first use, prefer devnet (test tokens) to exercise functionality before using mainnet with real USDC. - If you need stronger protection, consider using an encrypted key store or hardware signer rather than keeping raw secret keys in a plaintext config file. If you want, I can: (1) list exact files that hold private keys/config, (2) show the calls that use SILK_API_URL, or (3) draft a short checklist to harden local config and permissions before use.