8004 Skill

This skill implements on-chain registration and reputation and legitimately needs a signing key to submit transactions — but the registry metadata incorrectly lists no required credentials while the scripts and SKILL.md require TRON_PRIVATE_KEY/PRIVATE_KEY or a private-key file (~/.clawdbot/wallets/.deployer_pk) and optionally a PINATA_JWT. Before installing or running: 1) Do not use your mainnet production private key — use a throwaway/test key or hardware wallet; 2) Prefer using temporary or testnet keys and funds for initial testing; 3) Inspect utils.js (getPrivateKeyOrExit) to see exactly how keys are read and whether they are stored or logged; 4) Confirm contract addresses independently (e.g., via tronscan / bscscan) before sending transactions; 5) If you need IPFS pinning, create a dedicated pinning token, not one shared with other services; 6) Run npm install and consider doing commands in an isolated environment (container or VM) and run npm audit; 7) If you cannot review the code or do not trust entering a raw private key, do not install — instead interact with contracts via a hardware wallet or a custody service. The main red flag is the metadata omission of required secrets and the hard-coded local key file path — treat this as a configuration/information coherence issue and proceed cautiously.