xClaw02

The SKILL.md describes a legitimate purpose (making/receiving x402 payments, wallet management, probing 402 responses) and the required runtime binaries (node/npx/python3/pip) fit that purpose. However, the registry metadata declares no required environment variables or primary credential while the runtime docs explicitly reference a sensitive environment variable (XCLAW02_PRIVATE_KEY) and XCLAW02_NETWORK — this mismatch is unexplained.

The instructions tell the agent/user to create wallets, store config under ~/.openclaw/skills/xclaw02/, and to use XCLAW02_PRIVATE_KEY for signing payments. That means private keys or signing artifacts may be written to disk and read from env vars. The SKILL.md also instructs installing packages (pip install / npx) and running CLI commands that will fetch and execute remote code. Storing/handling private keys and automatically invoking installers are sensitive behaviors and should be carefully audited.

There is no install spec in the skill bundle itself (instruction-only), which is lower static risk. But the documentation expects the user/agent to run `pip install xclaw02` or `npx xclaw02`, which will pull code from package registries (npm/pypi). Because the skill package source is listed as 'unknown' and the registry header earlier said 'Homepage: none' while _meta.json embeds a homepage/repository, the provenance is ambiguous. Installing packages from registries is expected for this kind of tool but should be done only after verifying the package and repo.

Using a private key (XCLAW02_PRIVATE_KEY) is necessary to sign payments, so requesting a private key is proportionate to the payment purpose — but the skill metadata does not declare that env var as required, which is an inconsistency. The skill also instructs saving config and keys to a home directory path, which increases the persistence and blast radius if keys are compromised. No other external credentials are requested, but the omission of the private-key requirement from the declared requirements is notable.

always:false and model invocation defaults are fine. The skill will persist configuration and potentially private keys under ~/.openclaw/skills/xclaw02/, which is normal for a CLI wallet but is a persistence of sensitive material. The skill does not request system-wide privileges or claim to modify other skills.