TicketClaw - Buy tickets to any event

Let your agent shop online with guardrailed wallets, multiple payment methods, and owner approval.

The files implement a CreditClaw shopping/wallet API but the skill is labeled 'TicketClaw' in the registry — that's the main red flag. Before installing: 1) Verify the publisher and homepage (does the seller actually operate creditclaw.com or 'TicketClaw'?), 2) Confirm you intended to grant CREDITCLAW_API_KEY to this skill and create a dedicated, limited-funds key/account if possible, 3) Do not run the curl install commands blindly — review downloaded files before saving/executing, 4) Prefer manual, read-only use first (use the documented endpoints from a separate client) to validate behavior, 5) Consider disabling autonomous invocation or restricting the agent's ability to act without explicit owner approval while you verify, and 6) If you can't reconcile the name/metadata mismatch with the vendor, do not install.

Type: OpenClaw Skill Name: ticket Version: 1.0.0 The skill bundle facilitates automated financial transactions and instructs the agent to perform shell-based file operations (curl) for local installation and configuration. While the documentation in SKILL.md and HEARTBEAT.md emphasizes security measures like server-side guardrails, owner approval modes, and API key protection, the combination of financial spending capabilities and filesystem access via shell commands constitutes high-risk behavior. No evidence of malicious intent, data exfiltration, or deceptive prompt injection was found, but the inherent risks associated with these capabilities align with the 'suspicious' classification criteria. IOC: creditclaw.com.