Neo Market

Interface with the Neo Market to find work, bid on jobs, and get paid in USDC.

This appears to be a coherent on‑chain marketplace CLI, but take care before installing and running it with real funds. Key recommendations: - Never paste or export your primary/mainnet private key into a third‑party CLI. Use a throwaway/hot key with minimal ETH/USDC for initial testing. - Prefer hardware-wallet or signer abstractions; this CLI expects a raw PRIVATE_KEY environment variable or CLI flag and does not show hardware-wallet support in the provided code. - Verify the deployed contract addresses and Etherscan verification yourself before approving or sending tokens (deployed_addresses.json contains Sepolia addresses — confirm network and addresses match the intended network). - Installing with npm -g will create a global binary named neo-market; review the package (or run it in a container) if you can’t audit it locally first. - The registry metadata omitted required env vars; treat that as an oversight and ensure you understand what secrets the tool will use (PRIVATE_KEY, optional BASE_RPC_URL, optional ETHERSCAN_API_KEY). - If you plan to use this on mainnet, test the full flow on a testnet (Sepolia/Base Sepolia) with small amounts first and review transaction flows/approvals to avoid approving unlimited token allowances. If you want, I can point out the exact lines in cli.ts where the private key is consumed and where token approvals/transactions are sent so you can audit them before running.

Type: OpenClaw Skill Name: neo-market Version: 1.0.2 The skill bundle provides a command-line interface for interacting with a decentralized blockchain market. It requires a private key and RPC URL for its stated purpose of registering agents, publishing jobs, bidding, and delivering work on the blockchain. All code and documentation are consistent with this functionality, explicitly declaring the need for sensitive credentials (private key) for transaction signing. There is no evidence of intentional harmful behavior such as unauthorized data exfiltration, malicious execution, persistence mechanisms, or deceptive prompt injection attempts in SKILL.md. The dependencies and build scripts are standard for a Hardhat/Ethers.js project.