clawmegle staking

This skill's scripts do what a staking utility would — read balances, encode calldata, and sign/send transactions — but there are important red flags you should address before use: - Missing declared dependencies: the scripts call 'cast' (Foundry tool) and use python3, but the skill only listed curl, jq, and bc. Make sure you have 'cast' and python3 installed and inspect how they are used. - Undeclared secret/config requirements: the SKILL.md instructs you to store a Bankr API key at ~/.clawdbot/skills/bankr/config.json or to export PRIVATE_KEY. The registry metadata did not declare these. Treat this as sensitive — do not paste your private key into a shell unless you fully trust the code and developer. - Scripts sign and broadcast transactions: claim.sh, stake.sh, unstake.sh call cast with --private-key or instruct Bankr to submit arbitrary calldata. Any compromise or mistake could move funds. Prefer using Bankr API (so your signing key is managed by Bankr) or a hardware wallet rather than exporting a raw private key to env. - Autonomous behavior: HEARTBEAT.md gives auto-claim/auto-stake decision logic. Do not enable automatic heartbeats unless you explicitly want the agent to operate autonomously with your funds and you accept the risk. - Verify the contract and actor: independently verify the contract addresses on a block explorer (Basescan) and confirm the contract code/ownership before depositing funds. The skill's repository and owner appear to be from an unknown source — consider auditing the code or testing with a very small amount first. Concrete next steps before installing or running with real funds: 1. Inspect the bankr skill implementation referenced by bankr.sh; verify its origin and that it does not exfiltrate secrets. 2. Run the scripts locally in a safe environment and test read-only commands (check.sh, balance.sh) using a watch-only address (no PRIVATE_KEY exported). 3. If you must sign transactions, prefer submitting via Bankr (so you do not export PRIVATE_KEY to shell) or use a hardware wallet integration instead of setting PRIVATE_KEY in env. 4. Ask the publisher to update metadata: declare required binaries (cast, python3), declare required config paths and env vars (Bankr config and/or PRIVATE_KEY), and document heartbeat/autonomy clearly. Given the mismatches between declared metadata and the actual scripts, treat this skill as 'suspicious' until those gaps are resolved and you validate the bankr integration and contract addresses.