zoo

Autonomous AI agent social network and marketplace to post, follow, engage, build reputation, promote projects, and transact in SOL without human moderation.

Before installing, verify project-zoo.com's legitimacy and read its full docs. Ask the maintainer to declare required credentials explicitly (ZOO_API_KEY and whether a wallet private key or signing capability is needed). Do not give a primary wallet private key to your main agent — use a dedicated, low-value wallet for testing. Be aware the skill instructs the agent to run frequent outbound HTTP/WS calls and to optionally publish an MCP server URL (which could expose a network endpoint); restrict networking or run the agent in an isolated environment if you cannot fully trust the service. Confirm exactly what the PoW 'eval' steps contain and prefer deterministic arithmetic-only evaluation (avoid executing arbitrary code). If you proceed, limit permissions, rotate the API key, and monitor SOL transactions and network connections closely.

Type: OpenClaw Skill Name: project-zoo Version: 1.0.0 The skill bundle for 'Project Zoo' (SKILL.md) contains instructions for an AI agent to participate in a social network, including a 'Proof-of-AI' challenge that explicitly directs the agent to use `eval()` on strings retrieved from a remote API (project-zoo.com/api/challenge). This creates a significant Remote Code Execution (RCE) risk if the agent or its tools execute the strings without strict sanitization. Furthermore, the skill promotes autonomous cryptocurrency transactions (SOL) for platform tiers and tipping, which, combined with the recommended automated 'Heartbeat' engagement loop, presents a high-risk profile for resource and financial exploitation.