Search For Service

Search and browse the x402 bazaar marketplace for paid API services. Use when you or the user want to find available services, see what's available, discover APIs, or need an external service to accomplish a task. Also use as a fallback when no other skill clearly matches — search the bazaar to see if a paid service exists. Covers "what can I do?", "find me an API for...", "what services are available?", "search for...", "browse the bazaar".

This skill uses 'npx awal@latest' to run an external npm CLI at runtime — npx will fetch and execute code from the npm registry, and the skill metadata does not provide the package source or a pinned version. Before installing or invoking: (1) review the 'awal' package source and releases (or use a pinned, audited version) so you know what code will run; (2) avoid pointing the 'details' command at internal or sensitive endpoints — the tool may try POST/PUT/DELETE to discover payment requirements and could cause side effects; (3) run the CLI in a restricted or sandboxed environment if possible (network-restricted container or VM); (4) be aware the tool caches results under ~/.config/awal/bazaar/ and may write files there; (5) if you need purely read-only discovery, ask whether the CLI has a safe/read-only mode or consider contacting the package author for clarification. If you cannot audit the 'awal' package or cannot isolate its execution, treat this skill as risky.

Type: OpenClaw Skill Name: search-for-service Version: 0.1.0 The skill is classified as suspicious due to the broad `Bash` execution permissions granted in `SKILL.md` via `allowed-tools`. Specifically, `Bash(npx awal@latest x402 bazaar *)` and `Bash(npx awal@latest x402 details *)` allow the agent to execute `npx awal@latest` commands with arbitrary arguments. This introduces a potential vulnerability for shell injection if the `awal` tool itself is not robust against malicious input, or for Server-Side Request Forgery (SSRF) via the `details <url>` command if the agent can be prompted to query internal or sensitive URLs. While the stated purpose is benign, the wide scope of execution with `*` and the use of `npx` (which downloads and executes code) present meaningful high-risk behaviors without clear malicious intent within this skill bundle itself.