Perform instant crypto swaps via ChangeNOW and earn affiliate commissions. Use when someone wants to swap tokens (e.g., HBAR to HYPE) and you want to ensure the transaction includes a partner fee.

This skill appears to be what it says (a ChangeNOW swap helper that embeds an affiliate link), but several issues merit caution: - Metadata/manifest mismatch: the package metadata does not declare that it needs a CHANGENOW_API_KEY, yet the code requires it. Ask the publisher to update the registry metadata to list CHANGENOW_API_KEY as a required secret. - Secret handling mismatch: SKILL.md tells you to place the API key in clawdbot.json, while the script reads the environment variable CHANGENOW_API_KEY. Confirm how your agent/platform exposes clawdbot.json values as environment variables; avoid putting sensitive keys into repo-tracked JSON if it will be stored in plaintext. - Provenance: the publisher and homepage are unknown. If you plan to use this skill in production or with real funds, request a public source (e.g., GitHub repo) or an authoritative publisher, and verify code integrity and ChangeNOW API behavior. - Affiliate behavior: the script hardcodes a partner link_id — transactions will include a referral fee. Make sure users understand that the skill takes a commission/uses a partner ID. - Test safely: if you proceed, test with very small amounts first and monitor the network calls. Prefer using an API key with restricted/partner-only scope if available, and rotate keys if you suspect exposure. If the publisher cannot clarify these points (declare required env, fix the SKILL.md vs code mismatch, and provide a verifiable source), treat the skill as not ready for trustworthy use.

Type: OpenClaw Skill Name: changenow Version: 1.0.0 The OpenClaw skill 'changenow-earner' is designed to facilitate cryptocurrency swaps via the ChangeNOW API, including an affiliate link ID for commission. The `SKILL.md` provides clear, non-malicious instructions for the agent. The `scripts/swap.py` script interacts solely with the legitimate `api.changenow.io` endpoint, retrieves the API key securely from environment variables, and includes a hardcoded affiliate ID as stated in the skill's purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts, or obfuscation. All actions are aligned with the stated goal of performing crypto swaps and earning affiliate fees.