MintGarden

Browse and search Chia NFTs and collections, view stats, trade history, recent sales, trending data, and user profiles via MintGarden API.

This skill appears to do what it says: a MintGarden API client/CLI that talks to https://api.mintgarden.io. Before installing, consider: - The SKILL.md mentions an optional MINTGARDEN_API_URL env var, but the shipped index.js constructs MintGardenAPI() without reading process.env; if you need to point the skill at a different base URL you would need to modify the code or the constructor call. - The CLI lowercases incoming commands (index.js lowercases the entire input). That could alter case-sensitive IDs or metadata in some edge cases (verify behavior with your IDs). - Telegram integration is referenced in docs but not implemented in the code — expected to be provided by the agent/platform wiring. - The package requires npm install (and will install axios and its normal transitive deps). Review the package-lock.json and run npm audit if you want to check for dependency vulnerabilities. - The skill makes outbound network calls to api.mintgarden.io; if you need to restrict network access, run it in an environment that enforces outbound controls. If these points are acceptable, the code shows no signs of credential exfiltration or contacting unexpected endpoints. If you want stronger assurance, run the skill in a sandbox, inspect network traffic during use, or patch the code to honor a MINTGARDEN_API_URL environment variable if you require a custom endpoint.

Type: OpenClaw Skill Name: mintgarden Version: 1.0.0 The OpenClaw AgentSkills skill bundle for MintGarden is benign. All files, including code and documentation, align with the stated purpose of browsing and analyzing Chia NFTs via the MintGarden API. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The `SKILL.md` file provides instructions for the agent on how to use the skill and format its output, which is standard for a skill bundle and does not contain any prompt injection attempts to subvert the agent's core directives. Dependencies are limited to the legitimate `axios` library, and installation scripts use standard `npm install --production` commands.