xenodia

This package appears to be a legitimate Xenodia gateway client, but take these precautions before installing or enabling it: - Metadata mismatch: The registry metadata says there are no required environment variables, but CDP mode requires three sensitive Coinbase CDP values (CDP_API_KEY_ID, CDP_API_KEY_SECRET, CDP_WALLET_SECRET). Ask the publisher to fix the metadata or verify why it's omitted. - Secrets handling: Do NOT paste high-value secrets into ~/.zshrc unless you understand the risk. Storing API secrets or wallet secrets in a shell rc file leaves them in plain text accessible to any process that can read your shell files. Prefer a secure secret store (OS keyring, credential manager) or a file with restricted permissions. - Local private key: Local mode writes an unencrypted private key to .xenodia_agent_key. Only use local key mode if you accept storing the raw private key on disk; otherwise use CDP/MPC mode. - Verify endpoints and code: The scripts contact XENODIA_BASE_URL (default https://api.xenodia.xyz). Confirm that is the intended gateway. If you do not trust the Xenodia service or the skill source, do not provide credentials. - Limit exposure: If you must use this skill, avoid giving it autonomous privilege (or at least review/approve any actions that persist credentials). Consider running the scripts manually in an isolated environment rather than granting the agent automatic invocation. If you want, I can: (1) point out the exact lines where secrets are read/written, (2) produce a safer alternative for persisting credentials (restricted file with 600 permissions or keyring use), or (3) draft questions to ask the skill publisher to resolve the metadata mismatch.