Plugin

What to check before installing: - Metadata mismatch: the registry lists no required env vars but the README and code expect TOTALRECLAW_RECOVERY_PHRASE and TOTALRECLAW_SERVER_URL (and optionally many LLM API keys). Treat that as a red flag — ask the publisher why requirements were omitted. - Recovery phrase handling: the recovery phrase is the user's only identity and is irreversible. Do NOT reuse any cryptocurrency wallet seed; follow the skill's warning. Prefer interactive, ephemeral entry rather than placing the phrase in a long-lived environment variable if possible. - Sensitive env vars: the skill will read any provider API keys present in the environment. If you have provider keys in your environment, consider running the skill in an isolated environment or remove keys you don't want the skill to see until you've audited the code. - Inspect @totalreclaw/core: the crypto/WASM module performs critical crypto operations. Verify its provenance (npm page, code, signatures) and ensure its build artifacts are trustworthy before trusting the bundle. - Review SKILL.md and code for prompt/modification behavior: the pre-scan flagged a system-prompt-override pattern. Read the full SKILL.md and lifecycle hook implementations to ensure nothing attempts to override system prompts or exfiltrate secrets. - Prefer self-hosting: if you want to minimize trust, host the TotalReclaw server yourself (set TOTALRECLAW_SERVER_URL to your endpoint) and audit the server code; that reduces trust in the upstream service. - Test in isolation: run the skill in a sandboxed agent with no extra env credentials, monitor network calls to the configured server, and confirm that only encrypted blobs and expected headers (auth derived from recovery phrase) are transmitted. - If unsure, request more information from the publisher: source repo URL, signed releases, and an explanation for why registry metadata omits required envs. If the publisher cannot explain the discrepancies, avoid installing. Low vs. high confidence: this evaluation is high-confidence about the inconsistencies (metadata vs. code) and the presence of sensitive env var access and prompt-injection signal. It does not assert malicious intent — the code looks like a plausible E2EE memory implementation — but the mismatches and broad env access are sufficient to label the listing 'suspicious' and require manual vetting.