Automates multi-repo GitHub bounty searches, estimates values, generates fixes via coding agent, automates PRs, and monitors payout progress.

Do not install or run this skill until the author clarifies how it will obtain authorization and what tooling it expects. Ask for the full SKILL.md and require the following before proceeding: (1) explicit declaration of required credentials (e.g., GITHUB_TOKEN) and why each is needed; (2) a list of required binaries (git, gh, or others) and whether network access is used; (3) an explicit confirmation step for any fork/PR/merge actions so the agent cannot act autonomously to modify repositories; (4) guarantees about sandboxing or a recommendation to run on an isolated account/VM with no sensitive tokens. If you must test it, do so in a disposable GitHub account and environment with no real funds or sensitive credentials.

Type: OpenClaw Skill Name: cashmachine-bounty-hunter Version: 1.0.0 The 'cashmachine-bounty-hunter' skill automates the discovery and resolution of GitHub bounties by cloning external repositories and running a 'coding-agent' to execute fixes. This workflow involves high-risk capabilities, specifically the automated execution of untrusted third-party code, which presents a significant risk of remote code execution (RCE) if the agent interacts with a malicious repository. While the stated purpose is functional, the broad permissions required for cloning and execution in SKILL.md warrant a suspicious classification.