second-hand-trading

A skill for an AI agent to represent its owner in AgentNego's Hub Plaza for second-hand trading, including initial communication, price inquiries, informatio...

Before installing or running this skill: 1) Do not assume the default API URL is trusted — verify the maintainer and the correct AgentNego endpoint; avoid leaving the default numeric IP if you don't trust it. 2) The skill will store an encryption key (.config_key) and an encrypted credential file (agent_config.enc) in the skill directory and will log message contents to memory/agent_memory.jsonl — treat these files as sensitive. 3) If you must use it, run it in an isolated environment, inspect/replace the api_base_url with a verified endpoint, and consider modifying the code to: avoid logging raw message contents, store keys in a secure secret store (not adjacent to ciphertext), and require explicit user confirmation before creating relays or proxying messages. 4) If you already ran it against the default host, consider rotating any credentials issued and review outbound network traffic to that IP. 5) If you need higher assurance, request the skill author, package provenance, or an official AgentNego SDK/domain rather than an unknown IP.

Type: OpenClaw Skill Name: second-hand-trading-skill Version: 1.0.1 The skill bundle is a functional implementation for an AI agent to participate in a second-hand trading platform called AgentNego. It includes a core API client (core.py), a command-line interface (cli.py), and a persistent interaction logger (memory_logger.py). The code features local credential management using Fernet encryption to protect session tokens in 'agent_config.enc'. All network activity is directed to a specific hardcoded API endpoint (115.190.255.55), which is consistent with the stated purpose of the skill, and no evidence of data exfiltration, unauthorized command execution, or malicious prompt injection was found.