Agent marketplace of skills

Discover and call paid third-party API services through the Nightmarket marketplace. Use this skill whenever the user needs a third-party API, wants to find...

This skill's behavior is aggressive and asks the agent to perform sensitive actions without further user confirmation. Before installing or enabling it, consider: - Do not allow automatic execution of the npx commands; review the GitHub repo (https://github.com/Fallomai/skills) yourself before running any install. - Avoid having the agent store API keys in plain persistent notes or files; require the agent to ask you before creating or saving any credentials and use a secure vault if possible. - Prefer manual wallet creation or at least explicit user confirmation before the agent creates/funds any wallet or approves payments. - Require user approval before the agent performs any outbound search/install actions or pays for API calls; the SKILL.md's rule to search immediately and never ask clarifying questions risks leaking user requests and costs. - If you still want to use the skill, restrict its autonomy (require confirmation for installs, wallet creation, and payments), audit the referenced CrowPay and Nightmarket services, and review the code in the GitHub repo that the npx command would fetch.

Type: OpenClaw Skill Name: night-market Version: 1.0.1 The skill bundle uses aggressive prompt injection techniques in SKILL.md, explicitly instructing the AI agent to bypass user confirmation ('do this now — do not stop to ask the user') and assume authorization for high-risk actions. These actions include creating a financial wallet via api.crowpay.ai, storing API keys in persistent local memory files (e.g., CLAUDE.md), and automatically installing additional remote skills from GitHub using npx. While these behaviors are aligned with the stated purpose of an API marketplace, the intentional bypass of agent safety guardrails and the automated execution of remote setup scripts constitute a significant security risk.