← 返回 Skills 市场
nateliason

ClawMart Creator

作者 Nat Eliason · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
647
总下载
0
收藏
9
当前安装
1
版本数
在 OpenClaw 中安装
/install clawmart
功能描述
Create, manage, and publish ClawMart personas and skills directly from OpenClaw chat. Use when creating listings on ClawMart, uploading skill/persona package...
使用说明 (SKILL.md)

ClawMart Creator

Prerequisites

  • ClawMart creator account with active subscription
  • CLAWMART_API_KEY env var set (format: cm_live_...)

Commands

  • "Create a skill on ClawMart for [description]"
  • "Create a persona on ClawMart for [description]"
  • "Update my [listing name] on ClawMart"
  • "Upload a new version of [listing name]"
  • "Show my ClawMart listings"

Workflow

  1. Brainstorm listing ideas with user before writing metadata.
  2. ⚠️ DUPLICATE CHECK (mandatory): Before creating ANY new listing, search your existing listings first:
    • GET /listings — fetch all your current listings
    • Compare the proposed listing name, description, and category against existing ones
    • If a matching or very similar listing already exists, UPDATE it (PATCH /listings/{id} + new version) instead of creating a new one
    • Only proceed to POST /listings if no existing listing covers the same functionality
  3. Draft and confirm required fields: name, tagline, about, category, capabilities, price, product type.
  4. GET /me — validate creator access and subscription.
  5. POST /listings — create draft listing.
  6. Generate package files:
    • Persona: SOUL.md, MEMORY.md, supporting docs.
    • Skill: complete SKILL.md (follow skill-creator conventions).
  7. POST /listings/{id}/versions — upload package (multipart or base64 JSON).
  8. Ask for explicit user confirmation before publishing.
  9. Summarize: dashboard URL + public URL.

API Reference

  • Base URL: https://www.shopclawmart.com/api/v1/
  • Auth: Authorization: Bearer ${CLAWMART_API_KEY}
Method Endpoint Purpose
GET /me Creator profile & subscription
GET /listings List creator's listings
POST /listings Create listing metadata
PATCH /listings/{id} Update listing metadata
DELETE /listings/{id} Unpublish/delete listing
POST /listings/{id}/versions Upload package version

Price Field

⚠️ CRITICAL: The price field is in DOLLARS, not cents.

  • "price": 14.99 → $14.99 ✅
  • "price": 1499 → $1,499.00 ❌ (this is NOT cents!)
  • "price": 0 → Free listing ✅
  • Minimum paid price: $3.00

When a user says "set price to $14.99", send "price": 14.99. Do NOT multiply by 100. The API stores cents internally but accepts and returns dollar values.

Guardrails

  • Never expose raw API keys in chat output.
  • Require user confirmation before publishing.
  • Validate payloads before each API call.
  • Return clear errors with suggested fixes on failure.
安全使用建议
This skill appears to do what it says (talk to ClawMart's API to create/update listings) but there are two transparency issues: the SKILL.md requires CLAWMART_API_KEY while the registry metadata does not declare it, and the skill has no listed homepage or verifiable source. Before installing, ask the publisher for provenance (who published it, a homepage or repo), insist the manifest be updated to list CLAWMART_API_KEY as a required credential, and only provide an API key with the least privilege necessary (prefer a dedicated creator key or a key you can easily revoke). Do not paste your key into chat output; follow the guardrail in SKILL.md to avoid exposing it. If possible, test with a sandbox/limited account and rotate/revoke the key after initial use. If the publisher cannot provide provenance or update the metadata, treat the skill as higher risk and avoid installing it.
功能分析
Type: OpenClaw Skill Name: clawmart Version: 1.0.0 The skill is classified as suspicious due to the inherent prompt injection risk against the AI agent, specifically concerning its ability to generate and upload skill/persona packages (SKILL.md, SOUL.md, MEMORY.md) to an external platform (`shopclawmart.com`). While the skill's stated purpose and explicit guardrails (e.g., 'Ask for explicit user confirmation before publishing', 'Never expose raw API keys') are benign, the capability to generate arbitrary content for these packages based on user input, and then upload them via `POST /listings/{id}/versions`, presents a significant vulnerability for potential supply chain attacks on the ClawMart platform if the agent is successfully prompted to create malicious content.
能力评估
Purpose & Capability
The SKILL.md behavior (creating/updating listings via https://www.shopclawmart.com/api/v1/ and requiring a CLAWMART_API_KEY) matches the stated purpose of a ClawMart creator. However, the registry metadata lists no required environment variables or primary credential while the runtime instructions explicitly require CLAWMART_API_KEY — a manifest/metadata mismatch that reduces transparency.
Instruction Scope
The runtime instructions stay within the stated purpose: they describe listing checks, calls to /me, /listings, /listings/{id}/versions, package generation (SOUL.md, MEMORY.md, SKILL.md), and require explicit user confirmation before publishing. They do not instruct reading arbitrary system files or unrelated credentials. The only external dependency is the CLAWMART_API_KEY referenced in SKILL.md (not declared in metadata).
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is being downloaded or installed. That reduces the attack surface compared with skills that pull remote archives or binaries.
Credentials
The SKILL.md requires a CLAWMART_API_KEY (format cm_live_...) for API calls, which is appropriate for the task. However, the manifest/registry metadata fails to declare that required env var or any primary credential. The missing declaration is a transparency issue: users won't see in advance that a secret is needed. There are no other unexplained secret requests.
Persistence & Privilege
The skill does not request always:true and makes no install-time changes. It is user-invocable and allows normal autonomous invocation (disable-model-invocation=false), which is the platform default; there is no evidence the skill requests elevated or persistent privileges beyond using an API key.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawmart
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawmart 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Clawmart skill v1.0.0 – Initial release - Create, manage, and publish ClawMart personas and skills directly from OpenClaw chat. - Supports creating and updating listings, uploading skill/persona packages, and managing creator accounts. - Enforces duplicate listing checks and user confirmation before publishing. - Includes workflow steps, API reference, and detailed guidance on required fields and price formatting. - Provides guardrails for key handling, validation, and error reporting.
元数据
Slug clawmart
版本 1.0.0
许可证
累计安装 9
当前安装数 9
历史版本数 1
常见问题

ClawMart Creator 是什么?

Create, manage, and publish ClawMart personas and skills directly from OpenClaw chat. Use when creating listings on ClawMart, uploading skill/persona package... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 647 次。

如何安装 ClawMart Creator?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawmart」即可一键安装,无需额外配置。

ClawMart Creator 是免费的吗?

是的,ClawMart Creator 完全免费(开源免费),可自由下载、安装和使用。

ClawMart Creator 支持哪些平台?

ClawMart Creator 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 ClawMart Creator?

由 Nat Eliason(@nateliason)开发并维护,当前版本 v1.0.0。

💬 留言讨论