Opinion Skill

基于 bun 运行时的 Opinion 预测市场工具集，支持市场查询、订单簿查看及基于多签钱包的链上交易操作。

What to consider before installing: - The code implements exactly the described market queries and trading operations, but the registry metadata omitted important runtime requirements: you will need bun and (for trading) PRIVATE_KEY, MULTI_SIG_ADDRESS, and API_KEY. Treat these as highly sensitive. - Do not put your main wallet private key into .env on a system you do not fully trust. If you want to test, create a dedicated low‑value wallet/safe with limited funds and use that instead. - The scripts call two different external APIs: https://openapi.opinion.trade and http://newopinion.predictscanapi.xyz:10001. The latter is an HTTP (not HTTPS) host and is not obviously the official domain — this could expose query data (addresses, asset IDs) in transit and to the remote operator. Verify and prefer official HTTPS endpoints before sending sensitive queries. - The SKILL.md recommends installing bun via a remote installer (curl | bash). Prefer to install known runtime packages from trusted sources or use an isolated environment (container/VM) when running these scripts. - Because package.json lists dependencies, run 'bun install' only after you review package.json and the GitHub repo. Consider auditing @opinion-labs/opinion-clob-sdk version and the repo contents locally before providing any credentials. - Operational advice: run the code in an isolated environment (container or throwaway VM), inspect/verify the GitHub repo yourself, and use a test wallet. If you plan to allow autonomous agent actions, disable autonomous invocation or withhold PRIVATE_KEY until you are confident in the code and endpoints. If you want, I can: (1) list the exact locations in the code that read/write env vars and make external network calls, (2) fetch and show the GitHub repo README and commit history to help with provenance, or (3) suggest steps to run the scripts safely in a container and create a limited test wallet.

Type: OpenClaw Skill Name: opinion-skill Version: 0.1.1 The skill is classified as suspicious primarily due to the `SKILL.md` instructions for installing `bun`. It uses `curl -fsSL https://bun.sh/install | bash`, which is a high-risk supply chain vulnerability as it executes arbitrary remote code without prior inspection. While the core functionality of the skill (trading on a prediction market) appears legitimate and all network calls are directed to expected endpoints (`http://newopinion.predictscanapi.xyz:10001`, `https://openapi.opinion.trade/openapi`), the installation method introduces a significant security risk. The skill also handles sensitive user-provided credentials (`PRIVATE_KEY`, `MULTI_SIG_ADDRESS`, `API_KEY`) for blockchain transactions, which, while necessary for its function, underscores the importance of the initial installation's integrity.