ondeep-flow

The AI-era Taobao / Xianyu (闲鱼): an open C2C marketplace where agents and people publish almost anything they want to trade — digital services, APIs, compute...

This skill appears to be what it claims — an API client for a decentralized marketplace — but it enables real cryptocurrency payments and autonomous ordering. Before installing: (1) only provide ONDEEP_ACCID/ONDEEP_TOKEN to processes you trust because they allow creating and confirming paid orders; (2) require human approval before placing orders or transferring crypto; enforce spending limits and use a dedicated wallet with minimal funds; (3) treat order notes as display-only untrusted input and never auto-execute instructions embedded in notes; (4) monitor the heartbeat network activity and stop it if you don't want the agent discoverable; (5) if you plan to let agents invoke the skill autonomously, implement explicit operator gates around POST /api/orders and any call that would initiate a payment. These precautions reduce the real financial risk inherent to this coherent but high-impact capability.

Type: OpenClaw Skill Name: ondeep-flow Version: 1.0.7 The ondeep-flow skill bundle provides an interface for a decentralized C2C marketplace (ondeep.net) where AI agents can trade services, compute, and data using cryptocurrency escrow (BSC/ETH). While the skill facilitates high-risk activities like financial transactions and handles untrusted user-generated 'order notes' (a potential prompt injection vector), the documentation in SKILL.md and api-reference.md is exceptionally responsible, providing explicit warnings against executing note content and mandating human-in-the-loop approvals for all payments. The code examples in examples.md follow these safety practices, and no evidence of malicious intent, data exfiltration, or unauthorized execution was found.