Crypto trading: swap, perps, transfer, pay, deposit (credit card / crypto), withdraw, AI chat, market discovery, x402 payment, autopilot. Built-in wallet via...
Security Analysis
high confidenceThe skill's requirements and runtime instructions are coherent with a CLI-based crypto trading wallet: it needs the Minara CLI and an API key, and its instructions focus on trading and wallet operations with explicit confirmation for fund movements.
Name/description (crypto trading & wallet) matches requested artifacts: a 'minara' CLI binary, primary credential MINARA_API_KEY, and an npm install of the Minara CLI. The declared config path (skills.entries.minara.enabled) is an internal enable flag and is consistent with a skill that must be opt-in.
SKILL.md instructs the agent to check local CLI credentials (~/.minara/credentials.json), run 'minara login' (device-code/email flows), and execute a broad set of fund-moving commands. These actions are expected for a wallet/trading skill, and the file explicitly requires user confirmation before any fund movement. Note: the agent will access local credential files and relay device codes/URLs to the user as part of login flows — that is sensitive but proportional to the skill's purpose.
Install uses npm (minara@latest) to create a global 'minara' binary. Installing an unpinned 'latest' npm package is a common but non-negligible supply-chain risk; however the mechanism itself is proportionate to providing a CLI-based skill.
Only the Minara API key is declared as the primary credential (MINARA_API_KEY) and the skill reads the CLI credentials file. No unrelated credentials or broad environment access are requested. The requested access is necessary for wallet and trading operations, but is powerful (it controls funds), so treat the key and local credentials as highly sensitive.
Skill is not forced 'always' present and allows autonomous invocation (the platform default). It does not request special system-wide privileges beyond reading its own CLI credentials and enabling its entry in the skills config. Nothing indicates it modifies other skills or system config.
Guidance
This skill is internally consistent with a CLI-based crypto wallet, but it performs highly sensitive actions: installing the global 'minara' npm package will add a CLI that can move funds, and the MINARA_API_KEY or ~/.minara/credentials.json grant wallet access. Before installing: (1) verify you trust the Minara package source and/or review the npm package repository and publisher, and consider pinning to a known-good version instead of 'latest'; (2) do not place your primary/production API key in shared environments — use a least-privilege key if available; (3) be prepared to manually confirm every fund-moving operation (the skill enforces confirmation, but you must follow that flow); (4) understand that the skill may open browser flows (MoonPay) and will relay device codes/URLs to you; and (5) consider installing the CLI in an isolated environment (container or dedicated machine) if you want additional protection.
Latest Release
v2.4.12
Rewrite Quick Start with agent prompts, remove standalone CLI section.
Popular Skills
Published by @lowesyang on ClawHub
