← Back to Skills Marketplace
nateliason

ClawMart Creator

by Nat Eliason · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
647
Downloads
0
Stars
9
Active Installs
1
Versions
Install in OpenClaw
/install clawmart
Description
Create, manage, and publish ClawMart personas and skills directly from OpenClaw chat. Use when creating listings on ClawMart, uploading skill/persona package...
README (SKILL.md)

ClawMart Creator

Prerequisites

  • ClawMart creator account with active subscription
  • CLAWMART_API_KEY env var set (format: cm_live_...)

Commands

  • "Create a skill on ClawMart for [description]"
  • "Create a persona on ClawMart for [description]"
  • "Update my [listing name] on ClawMart"
  • "Upload a new version of [listing name]"
  • "Show my ClawMart listings"

Workflow

  1. Brainstorm listing ideas with user before writing metadata.
  2. ⚠️ DUPLICATE CHECK (mandatory): Before creating ANY new listing, search your existing listings first:
    • GET /listings — fetch all your current listings
    • Compare the proposed listing name, description, and category against existing ones
    • If a matching or very similar listing already exists, UPDATE it (PATCH /listings/{id} + new version) instead of creating a new one
    • Only proceed to POST /listings if no existing listing covers the same functionality
  3. Draft and confirm required fields: name, tagline, about, category, capabilities, price, product type.
  4. GET /me — validate creator access and subscription.
  5. POST /listings — create draft listing.
  6. Generate package files:
    • Persona: SOUL.md, MEMORY.md, supporting docs.
    • Skill: complete SKILL.md (follow skill-creator conventions).
  7. POST /listings/{id}/versions — upload package (multipart or base64 JSON).
  8. Ask for explicit user confirmation before publishing.
  9. Summarize: dashboard URL + public URL.

API Reference

  • Base URL: https://www.shopclawmart.com/api/v1/
  • Auth: Authorization: Bearer ${CLAWMART_API_KEY}
Method Endpoint Purpose
GET /me Creator profile & subscription
GET /listings List creator's listings
POST /listings Create listing metadata
PATCH /listings/{id} Update listing metadata
DELETE /listings/{id} Unpublish/delete listing
POST /listings/{id}/versions Upload package version

Price Field

⚠️ CRITICAL: The price field is in DOLLARS, not cents.

  • "price": 14.99 → $14.99 ✅
  • "price": 1499 → $1,499.00 ❌ (this is NOT cents!)
  • "price": 0 → Free listing ✅
  • Minimum paid price: $3.00

When a user says "set price to $14.99", send "price": 14.99. Do NOT multiply by 100. The API stores cents internally but accepts and returns dollar values.

Guardrails

  • Never expose raw API keys in chat output.
  • Require user confirmation before publishing.
  • Validate payloads before each API call.
  • Return clear errors with suggested fixes on failure.
Usage Guidance
This skill appears to do what it says (talk to ClawMart's API to create/update listings) but there are two transparency issues: the SKILL.md requires CLAWMART_API_KEY while the registry metadata does not declare it, and the skill has no listed homepage or verifiable source. Before installing, ask the publisher for provenance (who published it, a homepage or repo), insist the manifest be updated to list CLAWMART_API_KEY as a required credential, and only provide an API key with the least privilege necessary (prefer a dedicated creator key or a key you can easily revoke). Do not paste your key into chat output; follow the guardrail in SKILL.md to avoid exposing it. If possible, test with a sandbox/limited account and rotate/revoke the key after initial use. If the publisher cannot provide provenance or update the metadata, treat the skill as higher risk and avoid installing it.
Capability Analysis
Type: OpenClaw Skill Name: clawmart Version: 1.0.0 The skill is classified as suspicious due to the inherent prompt injection risk against the AI agent, specifically concerning its ability to generate and upload skill/persona packages (SKILL.md, SOUL.md, MEMORY.md) to an external platform (`shopclawmart.com`). While the skill's stated purpose and explicit guardrails (e.g., 'Ask for explicit user confirmation before publishing', 'Never expose raw API keys') are benign, the capability to generate arbitrary content for these packages based on user input, and then upload them via `POST /listings/{id}/versions`, presents a significant vulnerability for potential supply chain attacks on the ClawMart platform if the agent is successfully prompted to create malicious content.
Capability Assessment
Purpose & Capability
The SKILL.md behavior (creating/updating listings via https://www.shopclawmart.com/api/v1/ and requiring a CLAWMART_API_KEY) matches the stated purpose of a ClawMart creator. However, the registry metadata lists no required environment variables or primary credential while the runtime instructions explicitly require CLAWMART_API_KEY — a manifest/metadata mismatch that reduces transparency.
Instruction Scope
The runtime instructions stay within the stated purpose: they describe listing checks, calls to /me, /listings, /listings/{id}/versions, package generation (SOUL.md, MEMORY.md, SKILL.md), and require explicit user confirmation before publishing. They do not instruct reading arbitrary system files or unrelated credentials. The only external dependency is the CLAWMART_API_KEY referenced in SKILL.md (not declared in metadata).
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is being downloaded or installed. That reduces the attack surface compared with skills that pull remote archives or binaries.
Credentials
The SKILL.md requires a CLAWMART_API_KEY (format cm_live_...) for API calls, which is appropriate for the task. However, the manifest/registry metadata fails to declare that required env var or any primary credential. The missing declaration is a transparency issue: users won't see in advance that a secret is needed. There are no other unexplained secret requests.
Persistence & Privilege
The skill does not request always:true and makes no install-time changes. It is user-invocable and allows normal autonomous invocation (disable-model-invocation=false), which is the platform default; there is no evidence the skill requests elevated or persistent privileges beyond using an API key.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install clawmart
  3. After installation, invoke the skill by name or use /clawmart
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Clawmart skill v1.0.0 – Initial release - Create, manage, and publish ClawMart personas and skills directly from OpenClaw chat. - Supports creating and updating listings, uploading skill/persona packages, and managing creator accounts. - Enforces duplicate listing checks and user confirmation before publishing. - Includes workflow steps, API reference, and detailed guidance on required fields and price formatting. - Provides guardrails for key handling, validation, and error reporting.
Metadata
Slug clawmart
Version 1.0.0
License
All-time Installs 9
Active Installs 9
Total Versions 1
Frequently Asked Questions

What is ClawMart Creator?

Create, manage, and publish ClawMart personas and skills directly from OpenClaw chat. Use when creating listings on ClawMart, uploading skill/persona package... It is an AI Agent Skill for Claude Code / OpenClaw, with 647 downloads so far.

How do I install ClawMart Creator?

Run "/install clawmart" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is ClawMart Creator free?

Yes, ClawMart Creator is completely free (open-source). You can download, install and use it at no cost.

Which platforms does ClawMart Creator support?

ClawMart Creator is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created ClawMart Creator?

It is built and maintained by Nat Eliason (@nateliason); the current version is v1.0.0.

💬 Comments