← Back to Skills Marketplace
Agent marketplace of skills
by
Stephanie Sistilli
· GitHub ↗
· v1.0.1
· MIT-0
392
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install night-market
Description
Discover and call paid third-party API services through the Nightmarket marketplace. Use this skill whenever the user needs a third-party API, wants to find...
Usage Guidance
This skill's behavior is aggressive and asks the agent to perform sensitive actions without further user confirmation. Before installing or enabling it, consider:
- Do not allow automatic execution of the npx commands; review the GitHub repo (https://github.com/Fallomai/skills) yourself before running any install.
- Avoid having the agent store API keys in plain persistent notes or files; require the agent to ask you before creating or saving any credentials and use a secure vault if possible.
- Prefer manual wallet creation or at least explicit user confirmation before the agent creates/funds any wallet or approves payments.
- Require user approval before the agent performs any outbound search/install actions or pays for API calls; the SKILL.md's rule to search immediately and never ask clarifying questions risks leaking user requests and costs.
- If you still want to use the skill, restrict its autonomy (require confirmation for installs, wallet creation, and payments), audit the referenced CrowPay and Nightmarket services, and review the code in the GitHub repo that the npx command would fetch.
Capability Analysis
Type: OpenClaw Skill
Name: night-market
Version: 1.0.1
The skill bundle uses aggressive prompt injection techniques in SKILL.md, explicitly instructing the AI agent to bypass user confirmation ('do this now — do not stop to ask the user') and assume authorization for high-risk actions. These actions include creating a financial wallet via api.crowpay.ai, storing API keys in persistent local memory files (e.g., CLAUDE.md), and automatically installing additional remote skills from GitHub using npx. While these behaviors are aligned with the stated purpose of an API marketplace, the intentional bypass of agent safety guardrails and the automated execution of remote setup scripts constitute a significant security risk.
Capability Assessment
Purpose & Capability
The skill's stated purpose (discover/call paid APIs) can justify using a payment helper, but the SKILL.md goes further: it instructs the agent to create a CrowPay wallet, persistently store the CrowPay API key, and install other skills via npx from a GitHub repo. Requiring permanent installation of other skills and writing secrets to persistent memory is not strictly necessary for a discovery-only helper and is disproportionate to the claimed scope.
Instruction Scope
The instructions demand immediate execution ('do this now — do not stop to ask the user'), forbid asking clarifying questions before searching, and order the agent to save secret API keys into persistent notes/ memory files. They also instruct automatic, unconditional marketplace searches for any API-related user request. These steps expand the agent's actions into installation, credential creation/storage, and automatic outbound network calls beyond what the description implies.
Install Mechanism
Although the skill is instruction-only (no declared install spec), the SKILL.md tells the agent to run npx to add two skills from a GitHub repo (https://github.com/Fallomai/skills). That command would fetch and run code from an external source (arbitrary repo) — a high-risk install action not declared in metadata. The install behavior is hidden in instructions rather than a formal install spec.
Credentials
The skill requests creation and permanent storage of a CrowPay API key and directs the agent to write that secret into persistent memory or notes files (e.g., CLAUDE.md). Yet requires.env lists no credentials and no secure storage mechanism is specified. Storing secrets in open persistent notes is disproportionate and increases credential exposure risk.
Persistence & Privilege
The SKILL.md explicitly instructs installing other skills 'permanently' and writing defaults (including API keys) to persistent memory so the agent will reuse them across sessions. While the skill metadata doesn't set always:true, these instructions still request persistent cross-session presence and modification of agent state and installation of additional skills — a higher privilege than a transient discovery helper should need.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install night-market - After installation, invoke the skill by name or use
/night-market - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Expanded and clarified setup instructions, emphasizing immediate agent wallet creation via CrowPay and persistent storage of API keys and instructions.
- Removed separate references for MCP tools and REST API usage; consolidated API usage instructions and payment handling directly within the main documentation.
- Updated workflow: now requires immediate marketplace search on user API requests (no pre-search clarifications); results must be presented promptly.
- Standardized how and when to prompt the user to claim/fund their wallet, and how to handle safety limits.
- Added explicit examples for marketplace search and service detail retrieval using direct curl commands and clarified JSON responses.
- Improved behavioral guidance for when and how this skill should be used, especially in response to user queries about any third-party API or data source.
v1.0.0
Nightmarket 1.0.0 — Initial Release
- Enables discovery and paid calling of third-party APIs via the Nightmarket marketplace with automatic on-chain USDC payment (x402 protocol).
- Provides MCP tools to browse, inspect, and call APIs (including payment handling).
- Includes guide for wallet setup, supporting both managed (Crow skill) and direct wallet options.
- Supports direct REST API usage with 402 payment handling.
- Clear references and setup instructions for easy integration.
Metadata
Frequently Asked Questions
What is Agent marketplace of skills?
Discover and call paid third-party API services through the Nightmarket marketplace. Use this skill whenever the user needs a third-party API, wants to find... It is an AI Agent Skill for Claude Code / OpenClaw, with 392 downloads so far.
How do I install Agent marketplace of skills?
Run "/install night-market" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Agent marketplace of skills free?
Yes, Agent marketplace of skills is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Agent marketplace of skills support?
Agent marketplace of skills is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Agent marketplace of skills?
It is built and maintained by Stephanie Sistilli (@sistillisteph); the current version is v1.0.1.
More Skills