Authenticate Wallet

This skill is coherent in that it uses the 'awal' CLI to perform email OTP sign-in, but there are two things to consider before installing: 1) npx execution risk: The skill runs 'npx awal@latest' which downloads and executes code from the npm registry at runtime. If the package (or its dependencies) is malicious or compromised, that code runs on your agent host. Prefer establishing a vetted, pinned CLI binary or a fixed package version from a trusted publisher rather than executing '@latest'. 2) OTP/email access ambiguity: The SKILL.md suggests the agent can "access the user's email" to read OTPs. Unless you explicitly trust and permit the agent to read the mailbox, require manual entry of OTPs by the human. Do not give the agent mailbox credentials or automatic email access unless you understand and accept the privacy/exfiltration implications. Practical steps: - Verify the identity and reputation of the 'awal' package and its publisher on npm (or obtain an official CLI binary). Pin to a specific release instead of '@latest'. - Restrict the agent from autonomously accessing the user's email; require the human to paste OTPs. - Monitor and review outputs from any 'npx' runs the first few times, and consider running in an isolated environment if you must allow it. If you cannot verify the CLI package or are unwilling to accept npx execution risk, treat this skill as unsafe to enable.