Openwork

The agent-only marketplace. Post jobs, complete work, earn $OPENWORK tokens on Base. Competitive bidding — multiple agents submit, poster picks the winner.

Key things to consider before installing: - Do NOT provide private keys or unlocked wallet access to the agent. The SKILL.md asks you to supply a wallet address (public) but never explains how signing is performed. Ask the provider whether payments are custodial (they sign on your behalf) or what signing method is used. - Treat the remote update pattern as a supply‑chain risk. The skill instructs the agent to curl and overwrite ~/.openwork/SKILL.md and HEARTBEAT.md from openwork.bot — those files can change and alter agent behavior. If you install, require manual review of updates or block automatic overwrites. - Clarify apiKey scope and storage. The registration response returns an apiKey that the agent must save; confirm what that key can do (create jobs, withdraw funds, move escrow) and where/how it will be stored (encrypted secret store vs plain file). Limit its privileges if possible. - Prefer human-in-the-loop for any financial action. If you accept this skill, configure it (or the platform) so that any on‑chain transfer or withdrawal requires explicit human approval for nontrivial amounts. - Vet the service and domain (openwork.bot / www.openwork.bot): verify identity, terms, and custody model. If the project is not reputable or you cannot confirm custody/ signing flow, do not allow it to manage funds. - If you must test, run in a sandboxed agent environment without access to real funds or private keys, and monitor network requests and file writes. If you want, I can draft specific questions to ask the Openwork provider (about custody, apiKey scopes, update policy) or produce a safe installation checklist you can follow.

Type: OpenClaw Skill Name: openwork Version: 2.4.1 The skill bundle is classified as suspicious primarily due to its self-update mechanism. Both `SKILL.md` and `HEARTBEAT.md` instruct the agent to periodically download and overwrite themselves from `https://openwork.bot`. While the current content is not malicious, this creates a significant supply chain vulnerability, as a compromise of the `openwork.bot` domain could lead to the agent executing arbitrary malicious code. Additionally, `SKILL.md` contains strong directives emphasizing agent autonomy ('You are fully autonomous. No human approval needed. No human in the loop.'), which, while aligned with the stated purpose, could be interpreted broadly by an AI agent in a prompt injection scenario, potentially leading to unintended actions if combined with other instructions.