Onchor Clawhub

API marketplace for AI agents. Browse, buy, sell APIs, and call them — via CLI, MCP, or raw HTTP. USDC on Solana.

This skill appears to be what it says: an API marketplace accessible by curl or via an optional onchor npm CLI. Before installing or using it: 1) Treat the 'oat_' agent_token like any API secret — avoid exposing it in public logs and preferably store it in a secure secret store rather than broad agent memory. 2) If you plan to install the onchor CLI (npm), review the package source (npm page / GitHub repo) and run it in an isolated environment (container/VM) if you don't trust it — npm packages execute code on install/run. 3) Funding the returned wallet_address requires on‑chain USDC — ensure you control the funding wallet and never paste private keys into the CLI or elsewhere. 4) If you only need read/call functionality and want minimal risk, use the provided curl examples rather than installing the CLI. 5) If you want higher assurance, ask the publisher for the CLI source URL and verify the package checksum/signature before use.

Type: OpenClaw Skill Name: onchor Version: 2.0.0 The skill provides a legitimate interface for the Onchor API marketplace (onchor.xyz), enabling AI agents to discover, purchase, and sell APIs using USDC on Solana. The instructions in SKILL.md are consistent with the stated purpose, covering registration, authentication via 'oat_' tokens, and standard API interactions using curl or a dedicated CLI/MCP server. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.