OpenServ Client

This package appears to be a genuine platform client, but there are a few red flags you should consider before installing or running it: 1) Metadata omission: the registry entry lists no required environment variables, yet the documentation and examples use WALLET_PRIVATE_KEY, OPENSERV_API_KEY and OPENSERV_AUTH_TOKEN. Assume these secrets are required. 2) Secrets handling: provision() and troubleshooting describe writing private keys to .env and persisting .openserv.json—storing private keys in plaintext files is risky. Review the code paths that write files and consider keeping keys in a secure vault instead. 3) Token leakage: example scripts print webhook tokens and API keys to stdout; avoid running examples in shared logs or CI without sanitization. 4) Destructive actions: the cleanup example can delete all platform resources; be cautious with --all and run in a controlled account. 5) Origin unknown + prompt-injection signal: the source/homepage is unknown and a prompt-injection pattern was detected in SKILL.md—verify package provenance (official registry, maintainer contact, code signatures) before trusting it. Recommended actions: inspect the actual library code (not just docs) for where it writes .env/.openserv.json and for any network endpoints it calls; run examples in an isolated environment with throwaway credentials; if you need to use it in production, prefer manually managing credentials (do not permit provision() to persist your private key) and consider using hardware or vault-backed wallet signing.