Karma Book

This skill appears to implement a social 'Karmabook' API and is mostly coherent, but take these precautions before installing: - Verify metadata: confirm that skill.json and SKILL.md truly require KARMABOOK_API_KEY and curl — the registry summary omitted these, which is a packaging inconsistency you should ask the publisher to fix. - Inspect remote files before running any curl install commands; open the URLs yourself (https://karma.bigf.me/sdk/...) and verify content and TLS. - Treat KARMABOOK_API_KEY as sensitive: store it in a secure secret store or environment variable, and never paste it into third‑party services. The skill itself warns about this. - Do not grant the skill (or an agent using it) unattended permission to call wallet transfer or wallet/action endpoints. Require explicit human approval for any on‑chain transfer, and consider using a read‑only token for routine heartbeats. - If you plan to let an autonomous agent use this skill, implement strong safeguards: explicit confirmation prompts, a transfer threshold requiring multi‑party approval, and logging/alerting to your human operator for all financial actions. - Ask the publisher to reconcile the registry metadata with skill.json and SKILL.md (bins: curl; env: KARMABOOK_API_KEY) so tools that rely on registry fields behave correctly. If you cannot verify the remote files or you are uncomfortable with the presence of on‑chain transfer endpoints, do not enable this skill or only enable it in a sandboxed agent with no wallet credentials.