← Back to Skills Marketplace
274
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install nla-fulfill
Description
Fulfill an existing NLA escrow and collect tokens. Use when the user wants to submit fulfillment text for an on-chain escrow, check arbitration results, and...
Usage Guidance
This skill appears to do what it claims (help submit fulfillments and collect escrowed tokens), but the published metadata omits two important facts the SKILL.md makes explicit: you need the 'nla' CLI (npm package) and a private key/wallet with ETH for gas. Before installing or invoking this skill: 1) Do not expose your main/private production key — prefer a separate account with minimal funds, a hardware wallet, or manual signing. 2) Verify the 'nla' npm package and its repository/author before installing. 3) Avoid setting PRIVATE_KEY as a global env var that the agent can access; instead prefer manual --private-key entry or wallet prompt where possible. 4) If you permit the agent to run commands autonomously, be aware it could sign and broadcast transactions if it has access to the key. If you need more assurance, ask the skill author to update the registry metadata to declare required binaries and env vars, and to provide the npm package repository link.
Capability Analysis
Type: OpenClaw Skill
Name: nla-fulfill
Version: 1.0.0
The skill bundle facilitates on-chain escrow fulfillment using the 'nla' CLI, requiring high-risk capabilities such as shell execution (restricted to the nla namespace) and the handling of sensitive Ethereum private keys. While the instructions in SKILL.md are consistent with the stated purpose and lack clear malicious intent or prompt injection, the inherent risk associated with managing financial credentials and executing shell commands meets the threshold for a suspicious classification under the provided criteria.
Capability Assessment
Purpose & Capability
The SKILL.md describes exactly the expected actions for fulfilling an NLA escrow (checking status, submitting fulfillments, monitoring arbitration, collecting tokens). However the registry metadata does not declare the required 'nla' CLI or any environment variables even though the instructions explicitly require npm install -g nla and a private key/wallet. This mismatch is a transparency/consistency issue.
Instruction Scope
Runtime instructions tell the agent/user to submit on-chain transactions (commit-reveal flow) and to supply a private key (via PRIVATE_KEY env var, --private-key, or via 'nla wallet:set'). The SKILL.md reads/uses an environment variable and invokes a CLI — actions that can sign and broadcast transactions. The instructions do not ask the agent to read unrelated system files, but they do assume access to a sensitive secret (private key) that is not declared in the skill metadata.
Install Mechanism
There is no install spec in the registry (instruction-only skill), but SKILL.md requires the user to install 'nla' via npm (npm install -g nla). Installing a global npm package is a normal approach for CLI tools but carries moderate risk: the package source should be verified (author, package name, registry, and repository). The skill itself will not perform the install, so the responsibility falls to the user.
Credentials
The task legitimately requires a private key and ETH for gas, but the skill does not declare required env vars / primary credential in the metadata. Requiring a PRIVATE_KEY (or a wallet configured in the CLI) is sensitive and should be explicit. The absence of declared credentials in the registry metadata is an inconsistency that reduces transparency about what secrets the skill needs or may use.
Persistence & Privilege
The skill is not always-enabled and does not request persistent privileged platform hooks. However, because it instructs use of a signing key and allows CLI invocation, if the agent is granted the key or the CLI is pre-authorized the agent could autonomously sign and send transactions. Autonomous invocation is the platform default; combine that with private-key access only if you trust the agent behavior.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install nla-fulfill - After installation, invoke the skill by name or use
/nla-fulfill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
nla-fulfill v1.0.0 — Initial release
- Provides step-by-step instructions for fulfilling an on-chain NLA escrow using the nla CLI.
- Covers the entire fulfill-arbitrate-collect process, including crafting fulfillment text, submitting it, monitoring arbitration, and collecting tokens if approved.
- Outlines key requirements, command syntax, and prerequisite setup for users.
- Includes practical examples and highlights important details of the commit-reveal flow and arbitration outcomes.
Metadata
Frequently Asked Questions
What is Nla Fulfill?
Fulfill an existing NLA escrow and collect tokens. Use when the user wants to submit fulfillment text for an on-chain escrow, check arbitration results, and... It is an AI Agent Skill for Claude Code / OpenClaw, with 274 downloads so far.
How do I install Nla Fulfill?
Run "/install nla-fulfill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Nla Fulfill free?
Yes, Nla Fulfill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Nla Fulfill support?
Nla Fulfill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Nla Fulfill?
It is built and maintained by 疒奀 (@mlegls); the current version is v1.0.0.
More Skills