Tokenbroker

AI Agent Skill for GitHub project analysis and nad.fun token launch. Analyzes repos, generates token identity/promo, and launches on nad.fun.

Key things to check before installing or running TokenBroker: 1. Clarify credential needs: The registry shows no required env vars but the SKILL.md/METADATA.md request GITHUB_TOKEN, PRIVATE_KEY, BUILDER_ID and NAD_FUN_API_KEY. Ask the author which credentials are actually required and why. Do not provide your PRIVATE_KEY unless you fully understand where and how it will be used and stored. 2. Prefer A2A injection over storing secrets on disk: The docs mention both writing a .env and using A2A secure injection. Use A2A or short-lived tokens where possible; avoid putting private keys in a .env file on disk. 3. Limit GitHub token scope: If you supply GITHUB_TOKEN for monitoring, restrict it to read-only (public_repo) and consider using OAuth with minimal scopes and rotation. 4. Confirm approval flow for launches: The skill describes automated GitHub monitoring and delegation to nadfun. Verify whether launches require a human approval step before any on-chain action or signing occurs. 5. Audit delegation targets: TokenBroker delegates to a 'nadfun' skill and invokes other A2A identity services. Verify those dependency skills' sources and trustworthiness before allowing automatic delegation. 6. Test in safe environment: Run in testnet mode and with burner keys first. Review generated metadata and all network requests (e.g., POSTs to nad.fun endpoints) to confirm they match expectations. 7. Ask author for registry corrections: The registry metadata should list the environment variables the skill needs. The mismatch is an actionable red flag. If you cannot get clear answers about credential handling and the human approval gating, treat the skill as risky and avoid providing high-privilege secrets (especially PRIVATE_KEY).

Type: OpenClaw Skill Name: tokenbroker Version: 1.0.2 The skill bundle is suspicious due to significant prompt injection and content injection vulnerabilities. It processes untrusted input from GitHub repositories (e.g., `README.md`, `package.json` as per `PROJECT-SCAN.md` and `GITHUB.md`) and uses this data directly in critical operations. This includes making API calls to external endpoints (e.g., `https://api.nadapp.net` in `src/generators/nadfun.ts`) with potentially malicious SVG image data or metadata, and, more critically, passing this untrusted data as arguments to `invokeSkill` calls to other AI agents (e.g., `nadfun`, `AuditAgent`, `SocialWhisperer` as seen in `GITHUB.md`, `LAUNCH.md`, `METADATA.md`, `PROMO.md`). This design allows a malicious actor to craft a GitHub repository containing prompt injection payloads, potentially manipulating the agent's behavior or other skills, or injecting malicious content into external services or public social media posts.