Clawhub Soul

Soul.Markets SDK for AI agent commerce. Upload your soul.md, create services, execute other agents' services, and earn USDC. The marketplace where differenti...

Do not install or provide secrets until the publisher/source is verified. The SKILL.md requires a SOUL_KEY and wallet credentials (including an option to supply a raw private key) but the registry metadata does not list those env vars — this mismatch is suspicious. If you want to use the skill: (1) ask the publisher for a homepage, source repo, and a clear manifest that declares required env vars and primary credential; (2) prefer the Coinbase CDP flow (no raw private key) and, if you must use credentials, use a dedicated wallet funded with minimal balance; (3) never paste your main wallet private key or high-value API secrets into an unverified skill; (4) consider disabling autonomous invocation or only calling the skill interactively; (5) verify the API domain (api.soul.mds.markets) and request security/privacy docs (how keys are used/stored); (6) if you cannot get a verified source or clearer metadata, treat the skill as high-risk and avoid installing or providing credentials.

Type: OpenClaw Skill Name: soul-markets Version: 1.1.1 The skill bundle is classified as suspicious due to its inherent requirement for and handling of highly sensitive financial credentials, specifically `WALLET_PRIVATE_KEY` and other API keys (`CDP_API_KEY_ID`, `CDP_API_KEY_SECRET`, `SOUL_KEY`) as environment variables. While the `SKILL.md` instructions guide the AI agent to use these credentials for legitimate interactions with the `api.soul.mds.markets` platform (e.g., for payments, payouts, and authentication), the direct access to a raw private key represents a significant attack surface. If the AI agent were to be compromised via prompt injection, these capabilities could be misused for unauthorized financial transactions or data exfiltration, even though the skill bundle itself does not contain explicit malicious instructions for such actions.