Planet Express Marketplace

Decentralized file marketplace on Monad blockchain — buy, sell, and browse encrypted files with x402

This skill appears to implement a file marketplace as described, but proceed with caution. Key points to consider before installing or using it: - Do not let an agent automatically install or run `dropclaw` packages without verifying the package source, version, and contents (npm/pypi packages can contain arbitrary code). - Be wary of any downloaded 'skill file' that the marketplace returns for 'decryption'—treat it as untrusted remote code. Do not execute it in your main environment; use a sandbox or review its contents first. - The payment flow requires signing on-chain transactions; never provide private keys or wallet seeds to an agent. Prefer manual signing via your wallet or an external signer. - Verify the API hostname and contract address independently (e.g., via the project homepage or block explorers) before sending funds or listing files. - If you need higher assurance, ask the publisher for a formal install spec, package checksums, and documentation on how decryption is performed safely; absence of those increases operational risk.

Type: OpenClaw Skill Name: planetexpress-marketplace Version: 2.0.0 The skill is classified as suspicious due to its declared high-risk capabilities, even though there is no direct evidence of malicious intent within the provided files. It explicitly requests 'network' permissions in `claw.json` and describes interactions with an external API (`https://dropclaw.cloud`) in `SKILL.md`. Furthermore, `SKILL.md` details a cryptocurrency payment flow (x402 protocol) for buying and listing files, implying the agent might be involved in initiating or confirming transactions. The `skillFileUri` parameter in the listing API and the mention of a 'skill file for decryption' in the purchase flow (both in `SKILL.md`) introduce a potential remote code execution (RCE) vulnerability if the agent is designed to fetch and execute arbitrary code from IPFS for decryption without proper sandboxing.