SkillzMarket

Search and call monetized AI skills from Skillz Market with automatic USDC payments on Base. Use when the user wants to find paid AI services, call external skills with cryptocurrency payments, or integrate with the Skillz Market ecosystem.

This skill appears to do what it claims (look up paid skills and sign x402 payments), but it requires your wallet private key which is very powerful. Before installing: (1) only use a dedicated wallet with limited funds for this skill; never reuse your main wallet key; (2) prefer setting SKILLZ_PRIVATE_KEY as an environment variable or use a wallet with minimal balance rather than storing the key in ~/.openclaw/openclaw.json; (3) verify the upstream source/repository and the @x402 packages on npm (or use a vetted implementation) — the registry metadata has no homepage; (4) be cautious with the 'direct' command since it will POST to arbitrary URLs and can trigger payments; consider disabling autonomous model invocation or only invoking the skill manually; (5) if you need stronger guarantees, use a remote signing service or hardware wallet instead of exposing a raw private key. If you cannot verify the publisher or are uncomfortable exposing a private key, do not install.

Type: OpenClaw Skill Name: skillzmarket Version: 1.0.5 The skill is classified as suspicious due to its handling of a sensitive EVM private key (`SKILLZ_PRIVATE_KEY`) and the `direct` command in `skillz-cli.ts`. This command allows the agent to make cryptocurrency payments to any user-specified URL, which, while part of the stated purpose, presents a significant risk of unauthorized fund transfers if the agent is maliciously prompted. Although the `SKILL.md` and `README.md` clearly document this functionality and include security warnings, the inherent capability to direct payments to arbitrary endpoints makes it a high-risk feature without clear malicious intent from the skill developer itself.