Windfall Inference

Spatially-routed LLM inference at $0.004/req. Routes to cheapest, greenest energy. 200+ models. OpenAI-compatible. Onchain attestations on Base.

What to consider before installing or using this skill: - If you only want to call Windfall's hosted API: you only need to provide WINDFALL_API_KEY to the agent. Verify the endpoint (https://windfall.ecofrontiers.xyz) and avoid reusing sensitive keys. - The bundle contains a full server implementation (deploy script, package.json, many src/ services). Do NOT run or 'npm install' these files unless you trust the publisher and have audited the code; running them will fetch many third-party packages and may require blockchain/payment secrets. - If you intend to self-host the code: read the source thoroughly for required environment variables (Stripe, Ethereum RPC keys, EAS attestation config, x402 keys) and note the Business Source License in LICENSE.md which restricts offering a competing commercial inference gateway. - Treat the WINDFALL_API_KEY as a scoped credential: prefer least-privilege, generate ephemeral/test keys where possible, and monitor usage. Consider using a separate key for the agent and avoid sharing cloud/provider credentials. - Verify the operator identity (homepage, organization, package provenance). The registry owner is an opaque ID; if you require high assurance, confirm the project's repository, maintainers, and TLS fingerprint of the API endpoint. - If you need a higher-assurance classification, provide the contents of src/config.ts and src/index.ts (or allow an independent code audit) — those files will show exactly what environment variables and outbound endpoints the server uses and whether any unexpected exfiltration occurs.

Type: OpenClaw Skill Name: windfall-inference Version: 1.0.0 The OpenClaw AgentSkills skill bundle for "windfall-inference" is classified as **benign**. The skill bundle implements a spatially-routed LLM inference gateway with features such as dynamic model selection, energy-aware routing, semantic caching, and on-chain attestations. The codebase demonstrates strong security practices, including API key hashing, input validation, rate limiting, CORS restrictions, and secure session management. Notably, the `src/services/acp-handler.ts` file explicitly validates incoming requests, rejecting any that are not LLM inference (e.g., blockchain token swaps), which is a critical security control against misuse. The `SKILL.md` and `testing-guide.md` files serve as benign documentation and testing instructions for human users, without any evidence of prompt injection attempts against an AI agent. While the `deploy/setup.sh` script executes a remote script from `deb.nodesource.com` for Node.js installation, this is a common and generally trusted practice for server setup and does not indicate malicious intent.