ens-manager

This skill generally does what it claims (register ENS names and set IPFS content) and includes the scripts to do it, but there are a few red flags you should address before using it with real funds: - Review the scripts first. They handle your private key / keystore locally; verify the decrypt/write flows and ensure no code sends raw private keys to external servers. The repo is bundled so you can audit it locally. - Protect wallet material. Prefer using a secure signing provider or an offline key rather than passing --password on the command line (shell history) or storing an unencrypted private key. If you must use a keystore+password, pass the password via a file descriptor or secure agent, not a plain CLI argument. - Test on a testnet or with a throwaway wallet before using production ETH. Use dry-run modes first where available. - Use a trusted RPC provider (or your own node) rather than the skill's default public endpoints — public RPCs can log requests (including the addresses involved) and may impose rate limits. - Note the docs/code mismatches: SKILL.md and changelog mention --private-key-env and specific default RPCs, but the scripts are inconsistent. Confirm the exact command-line options in the JS files before running. - Manually remove or inspect any hidden/unicode control characters in SKILL.md and other docs to ensure the content hasn't been obfuscated. If you want, I can: (1) point out the exact lines of code that read/decrypt the keystore and how they handle the private key, (2) search the scripts for any network calls beyond the RPC endpoints, or (3) produce a safe checklist of commands to run this skill with minimal exposure (dry-run, test wallet, local RPC).