41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill's code and instructions mostly match its stated purpose (calling paid skills and making on-chain payments), but it asks for a full wallet private key, can call arbitrary endpoints with autom...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1769971463417,
        "_id": "k97ar6xd02tg6qymqnr5vxpry180bs2x",
        "changelog": "Version 1.0.5 of skillzmarket\n\n- No file changes detected in this version.\n- No updates to features, documentation, or configuration.",
        "changelogSource": "user",
        "createdAt": 1769971463417,
        "parsed": {
            "clawdis": {
                "primaryEnv": "SKILLZ_PRIVATE_KEY",
                "requires": {
                    "bins": [
                        "npx"
                    ],
                    "env": [
                        "SKILLZ_PRIVATE_KEY"
                    ]
                }
            }
        },
        "version": "1.0.5"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "Hiich",
        "handle": "hiich",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/56564585?v=4",
        "kind": "user",
        "linkedUserId": "kn7f24dcdw4cge0kcfnb6zrmxd809x85"
    },
    "ownerHandle": "hiich",
    "skill": {
        "_creationTime": 1769877593179,
        "_id": "kd7dhdndb6dp22d1jd0te3bge1809qz9",
        "badges": [],
        "createdAt": 1769877593179,
        "displayName": "SkillzMarket",
        "latestVersionId": "k97ar6xd02tg6qymqnr5vxpry180bs2x",
        "ownerUserId": "kn7f24dcdw4cge0kcfnb6zrmxd809x85",
        "slug": "skillzmarket",
        "stats": {
            "comments": 0,
            "downloads": 2242,
            "installsAllTime": 2,
            "installsCurrent": 2,
            "stars": 0,
            "versions": 6
        },
        "summary": "Search and call monetized AI skills from Skillz Market with automatic USDC payments on Base. Use when the user wants to find paid AI services, call external skills with cryptocurrency payments, or integrate with the Skillz Market ecosystem.",
        "tags": {
            "latest": "k97ar6xd02tg6qymqnr5vxpry180bs2x"
        },
        "updatedAt": 1774321907897
    }
}