功能描述

Open Source Intelligence (OSINT) tool for researching individuals - professional backgrounds, career timelines, due diligence, competitive intelligence, and investor research. Use when users need to research people, verify credentials, or gather professional information. Costs $0.15 USDC per request via x402 protocol on Base network.

使用说明 (SKILL.md)

Find People (OSINT)

Name: Find People (x402)
Author: tzannetosgiannis

Research individuals using Open Source Intelligence gathering and AI-powered analysis.

Configuration

The private key must be available via one of these methods:

Option 1: Environment variable

export X402_PRIVATE_KEY="0x..."

Option 2: Config file (Recommended)

The script checks for x402-config.json in these locations (in order):

Current directory: ./x402-config.json
Home directory: ~/.x402-config.json ← Recommended
Working directory: $PWD/x402-config.json

Create the config file:

{
  "private_key": "0x1234567890abcdef..."
}

Example (home directory - works for any user):

echo '{"private_key": "0x..."}' > ~/.x402-config.json

Usage

Run the research script with a person's name or description:

scripts/research.sh "\x3Cperson query>"

The script:

Executes OSINT research with payment handling
Costs $0.15 USDC per request (Base network)
Returns comprehensive AI-processed intelligence report

Examples

User: "Find information about the founder of Ethereum"

scripts/research.sh "Vitalik Buterin Ethereum founder"

User: "Research the CEO of OpenAI"

scripts/research.sh "Sam Altman OpenAI CEO"

User: "Tell me about Elon Musk's career timeline"

scripts/research.sh "Elon Musk career history"

Capabilities

Professional background research
Career timeline verification
Due diligence on potential hires/partners
Competitive intelligence on industry leaders
Investor research on startup founders
Educational background verification
Public accomplishments and publications

Error Handling

"Payment failed: Not enough USDC" → Inform user to top up Base wallet with USDC
"X402 private key missing" → Guide user to configure private key (see Configuration above)
Timeout errors → The API has a 5-minute timeout; comprehensive research may take time

Use Cases

Hiring: Verify candidate backgrounds and experience
Partnerships: Due diligence on potential business partners
Investment: Research startup founders and leadership teams
Competitive Analysis: Track industry leaders and their moves
Journalism: Background research for interviews or articles

安全使用建议

What to consider before installing/using this skill: - Do not upload or paste your main blockchain private key unless you fully trust the code and publisher. The skill instructs you to store the private key in an env var or plaintext file (~/.x402-config.json), which is high-risk. - The script runs 'npx -y @itzannetos/x402-tools-claude', which downloads and executes code from npm at runtime. That package could read and exfiltrate any local files or keys available to the process. - Metadata is inconsistent: the registry claims no required credentials/binaries, but the README/script require a private key, jq, and Node/npm. This mismatch is a red flag. - If you must test: use an isolated environment (VM/container) and a throwaway wallet with minimal funds/USDC; audit the npm package source (and its maintainer) before running; ensure jq and Node versions are safe; prefer running the npm package code locally after review rather than via npx. - Ask the publisher for missing details: the npm package repository URL, package maintainer identity, why a raw private key is required, and whether a delegated/authenticated payment mechanism (wallet connect, signing via hardware wallet, or ephemeral key) is supported. - If you are uncomfortable supplying a private key or executing unverified remote code, do not install or run this skill.

功能分析

Type: OpenClaw Skill Name: find-people Version: 1.0.0 The skill bundle is designed for OSINT research requiring payment via the x402 protocol. It transparently handles a private key, which is necessary for its stated payment functionality, by reading it from environment variables or a specified config file (`x402-config.json`). The `SKILL.md` documentation provides clear instructions for users and does not contain any prompt injection attempts against the AI agent. The `research.sh` script executes a specific, named `npx` package (`@itzannetos/x402-tools-claude`) to perform the research. All actions are directly aligned with the stated purpose, and there is no evidence of unauthorized data exfiltration, malicious execution, persistence, or obfuscation beyond the functional requirements.

能力评估

⚠ Purpose & Capability

The skill claims to be an OSINT 'find people' tool that charges via the x402 protocol, which plausibly requires a payment key — but the registry metadata lists no required environment variables or credentials. The included script and documentation in SKILL.md explicitly require an X402 private key and call out Base/USDC payments. Also the script requires jq and Node/npm (npx) at runtime but the metadata declares no required binaries. These mismatches indicate the declared metadata is incomplete or misleading.

⚠ Instruction Scope

SKILL.md instructs the user to place a private key in an environment variable or in a config file in the home/current directory. The script reads config files from multiple locations ($HOME, PWD) and exports X402_PRIVATE_KEY, then runs 'npx -y @itzannetos/x402-tools-claude find-people "$QUERY"'. The script itself does not transmit the key, but invoking an npm package fetched at runtime gives that package the opportunity to access and exfiltrate the private key or other data. The instructions also recommend creating a plaintext file in the home directory for a private key — a risky practice.

⚠ Install Mechanism

There is no install spec, but the script uses 'npx -y' which will fetch and execute @itzannetos/x402-tools-claude from the npm registry at runtime. This is a moderate-to-high risk action because it runs unverified remote code. The npm package author/publisher is not documented in the skill metadata or homepage, and the package name does not obviously match the skill owner. The script also relies on jq and Node/npm, but those binaries are not declared in metadata.

⚠ Credentials

The skill requires a sensitive X402 private key (used to pay USDC on Base), but the registry metadata lists no required env vars or primary credential. Asking users to store a blockchain private key as plaintext in ~/.x402-config.json or an env var is disproportionate without strong safeguards. The skill reads config files in multiple locations, which can increase accidental exposure if run in shared contexts. No justification is provided for why a raw private key is necessary versus a safer payment/auth pattern.

✓ Persistence & Privilege

The skill does not request 'always: true' and does not modify other skills or system settings. Autonomous invocation is allowed (platform default) — note that if an agent has access to the private key and can autonomously invoke the skill, the risk increases, but that is a platform-level consideration rather than a direct misconfiguration of this skill.

版本历史

v1.0.0

Initial public release of "find-people" skill. - Enables OSINT-powered research on individuals, including professional backgrounds and career timelines. - Supports due diligence, competitive intelligence, investor research, and credential verification. - Charges $0.15 USDC per request, processed via the x402 protocol on the Base network. - Configurable private key setup via environment variable or config file. - Provides error handling for payment, missing key, and timeout issues. - CLI script for querying and retrieving comprehensive AI-processed reports.

元数据

Slug find-people

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题

Find People (x402) 是什么？

Open Source Intelligence (OSINT) tool for researching individuals - professional backgrounds, career timelines, due diligence, competitive intelligence, and investor research. Use when users need to research people, verify credentials, or gather professional information. Costs $0.15 USDC per request via x402 protocol on Base network. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 2305 次。

如何安装 Find People (x402)？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install find-people」即可一键安装，无需额外配置。

Find People (x402) 是免费的吗？

是的，Find People (x402) 完全免费（开源免费），可自由下载、安装和使用。

Find People (x402) 支持哪些平台？

Find People (x402) 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Find People (x402)？

由 TzannetosGiannis（@tzannetosgiannis）开发并维护，当前版本 v1.0.0。

Find People (x402)