Agent Harness

Agent Harness管理工具 - 创建、配置和使用ACP (Agent Coding Platform) harness进行代码开发。支持Claude Code、Codex、Gemini CLI等主流AI编码助手。

This skill claims to be an Agent Harness but includes a payment module with a hard-coded API key and outbound network calls. Before installing or using it: (1) ask the author for source repository/homepage and verification of the payment flow; (2) insist the SkillPay key be removed from source and provided via an environment variable or secret store so it can be rotated; (3) verify the payment endpoint (api.skillpay.io) and whether the skill actually enforces payment or just logs it; (4) treat the embedded key as compromised—do not rely on it, and if you proceed, rotate any associated credentials; (5) if you cannot validate the author/source and the payment implementation, avoid installing the skill or run it in an isolated environment where outbound network access is restricted.

Type: OpenClaw Skill Name: shenmeng-agent-harness Version: 1.0.0 The skill bundle implements a mandatory USDT payment system ('SkillPay') that communicates with an external API (api.skillpay.io) and contains a hardcoded API key in payment.py. While the SKILL.md instructions describe a tool for managing AI agents like Claude Code and Codex, the bundle relies on several undefined external commands (e.g., sessions_spawn, subagents) and introduces a financial gate that is highly unusual for OpenClaw skills. The hardcoded credential and the requirement for cryptocurrency payments represent significant security and trust risks, although there is no explicit evidence of traditional malware like data exfiltration or backdoors.