Scout

Agent trust intelligence for Moltbook and x402 Bazaar. Use when you need to check if an agent or service is trustworthy before paying, compare agents side-by-side, scan feeds for quality agents, or make trust-gated USDC payments. Answers the question "should I pay this agent?" with research-backed scoring across 6 dimensions.

What to consider before installing or running Scout: - Metadata mismatch: The registry metadata claims no required env vars/binaries, but SKILL.md and the code require Node/npm and a MOLTBOOK_API_KEY (and optionally a SCOUT_PRIVATE_KEY for payments). Treat the SKILL.md/code as authoritative and do NOT assume no secrets are needed. - Sensitive credentials: MOLTBOOK_API_KEY is required for almost every script and grants read/write access to Moltbook endpoints (the DM bot posts replies). Only provide this key if you trust the code and run it in a controlled environment. SCOUT_PRIVATE_KEY is a private wallet key — only supply a throwaway/dedicated payment key with limited funds and permissions, never your primary wallet key. - Prefer the hosted API when possible: Using the public API at https://scoutscore.ai avoids giving this environment your Moltbook API key or private key. If you only need a quick score, call the remote API rather than running local scripts. - Inspect and sandbox: If you plan to run local scripts, review the scripts that will run (dm-bot, api-server, safe-pay). Run them in a sandboxed environment or container, with network access restricted if you don't want outgoing requests. Be aware that the dm-bot will read and send DMs using the provided API key. - Use dry-run and limited keys: For payment testing, use the --dry-run option and a testnet wallet with only small amounts. Consider creating a Moltbook API key with minimal permissions if the platform supports it. - Verify provenance: The SKILL.md links to scoutscore.ai and a GitHub repo, but the package/demo pages include an oddly truncated GitHub CTA (possible mismatch). Try to find the canonical project repo and confirm the publisher before trusting secrets to this code. If you want, I can list the exact files and lines that require MOLTBOOK_API_KEY and SCOUT_PRIVATE_KEY, or suggest a safe checklist and a sandbox command set to run the scripts with minimal risk.

Type: OpenClaw Skill Name: scout Version: 1.0.2 The skill bundle is classified as suspicious due to its inherent high-risk capabilities, specifically the handling of a `SCOUT_PRIVATE_KEY` for initiating on-chain USDC transactions via `scripts/safe-pay.js` and `scripts/lib/usdc.js`. While these actions are explicitly aligned with the stated purpose of 'trust-gated USDC payments,' the direct management of private keys and execution of financial transactions constitutes a significant risk. Additionally, the skill performs extensive external network calls to various blockchain explorers (e.g., `api-sepolia.basescan.org`, `api.etherscan.io`) and the Moltbook API (`moltbook.com`) for data collection and analysis, which, though necessary for its functionality, broadens its attack surface. There is no clear evidence of intentional malicious behavior such as unauthorized data exfiltration, persistence, or prompt injection against the OpenClaw agent in the `SKILL.md`.