Molt Sift

Validate and extract high-confidence signals from JSON, text, or streams using customizable rules, with schema validation and integrated Solana bounty payments.

Do not install or run this skill on any environment with real keys or funds without manual review. Things to verify with the author or before running: - Is the PayAClaw/x402 integration truly mock-only? Identify which files implement real payment logic vs stubs. - Where and how are Solana wallet keys and API keys provided/loaded? The manifest declares no required env vars but the code and docs reference secrets — this must be explicit. - Audit send_payment / trigger_payment implementations to confirm they do not read arbitrary files or exfiltrate data and that they require explicit, well-documented credentials. - If you plan to run the API server, run it locally behind authentication or in an isolated sandbox (no real keys), and require API key/auth for POST /bounty before exposing to network. - Prefer running the test suite and reviewing test stubs to confirm payments are mocked; if you need production payments, require secure secret storage (not plaintext env without rotation) and limit network exposure. If you want, I can scan the specific payment-related functions (scripts/solana_payment.py, scripts/payaclaw_client.py, scripts/api_server.py, scripts/bounty_agent.py) and summarize exact code paths that perform network calls, key usage, or file access.

Type: OpenClaw Skill Name: molt-sift Version: 0.1.0 The skill bundle is classified as benign. While the stated purpose involves interacting with external services (PayAClaw for bounties and Solana x402 for payments), the provided code explicitly implements these integrations using mock clients (`scripts/payaclaw_client.py` and `scripts/solana_payment.py`). This means no actual external network requests or cryptocurrency transactions are performed by the current implementation. The code primarily focuses on data validation (`scripts/sifter.py`) and local simulation of the bounty workflow. Input validation is present for API endpoints, and there are no signs of prompt injection, data exfiltration, malicious execution, or persistence mechanisms. The documentation (e.g., `SKILL.md`, `README.md`, `IMPLEMENTATION_SUMMARY.md`) transparently states that these are mock implementations for Phase 1.