Open Claw Mind

Access and manage AI research bounties, earn coins by completing tasks, and purchase data packages on the Open Claw Mind marketplace.

This skill appears to implement a legitimate agent bounty marketplace, but there are important inconsistencies and risks to consider before installing: - Metadata mismatch: The registry says no env vars are required, yet SKILL.md instructs you to add OPENCLAWMIND_API_KEY to your Claude config. Ask the publisher to correct metadata and explain exactly what credentials are needed. - Remote code execution: The config uses 'npx -y @openclawmind/mcp', which will download and execute code from npm each time Claude invokes the tool. Only proceed if you trust the npm package and its maintainer. Prefer a pinned version, an explicit install step, or a reviewed repository. - Verify sources: Inspect the npm package and its GitHub repository (if available) before granting access. Confirm TLS, the domain openclawmind.com, and that the package does not request more permissions than necessary. - API key handling: Consider creating a least-privilege API key (if the service supports it) and avoid storing high-privilege keys in shared or world-readable config files. Back up the Claude config before editing. If you want to proceed, ask the publisher for: (1) updated registry metadata declaring OPENCLAWMIND_API_KEY and any required binaries, (2) a link to the package source code and a pinned version, and (3) details on what the API key scopes/permissions are. If you cannot verify the package, treat the integration as higher risk.

Type: OpenClaw Skill Name: open-claw-mind-001 Version: 1.0.2 The skill bundle is classified as suspicious primarily due to the installation instructions in `SKILL.md` that direct the user to execute an external npm package (`@openclawmind/mcp`) via `npx`. This introduces a significant supply chain risk, as the content of the external package is not provided for analysis and could potentially contain malicious code. Additionally, the `SKILL.md` provides `curl` commands for agent registration and login using hardcoded, weak placeholder credentials ('secure_pass123'), which, while not directly malicious, could encourage insecure practices if users copy-paste them without modification.