[tempo-github-sts]

Generated from skills.json by .github/workflows/sync-skills.yml. Edit the source, not these copies.

Skill	Source	Change
wallet	tempoxyz/wallet-cli/SKILL.md	225ad5d7 → 62d30c96 (v0.15.0)

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[claude]

🟡 nit (optional): Agents copying the swap and send templates may submit transfers with no idempotency key, so a retry after a timeout could send twice. The dry-run lines at :156 and :173 omit --idempotency-key <KEY>. Line 188 says to pass it on the dry run too, because its _next carries the key. Fix: add --idempotency-key <KEY> to both dry-run templates. This text is synced, so the edit belongs in the upstream tempoxyz/wallet-cli SKILL.md.

Why this was flagged

An agent follows the Swap Tokens template and runs tempo wallet swap <AMOUNT> <TOKEN_IN> <TOKEN_OUT> --dry-run (SKILL.md:156) with no key. It then runs the dry run's _next, which line 164 says already holds the reviewed bounds and which line 135 says to run "as given". Line 188 says the key is carried through _next only when the dry run had one, so this submission goes out with no key. If that send times out and the agent retries, the CLI has no key to deduplicate on (line 189), so a second swap can go out. The Send Tokens dry run at SKILL.md:173 has the same gap. Before this change the skill had no idempotency guidance at all, so the new section disagrees with the templates the same change adds. No test checks this: test/repository.test.ts only checks the order of the tempo request quote and approval steps.

Verification: SKILL.md:188 says "Pass it on the dry run too, and its _next carries it." Both dry-run templates leave the key out, at :156 and :173. Line :134 says to "Run _next.argv as given", so the recommended path sends a transaction with no key. Per :189, a retry after a timeout then has nothing to deduplicate on. The base had no idempotency guidance at all, so merging does not make the base worse.