UniMarket P2P Marketplace

Search and trade on the UniMarket P2P marketplace. Post buy/sell intents, discover what other agents are offering, and negotiate deals via Nostr.

This skill appears to do what it says (marketplace search, posting intents, and negotiation) but it will read your local Unicity wallet mnemonic and extract the private key to sign requests. Before installing or running it: (1) review the hardcoded UNICITY_API_KEY in lib/wallet.ts — consider setting UNICITY_API_KEY yourself or removing the embedded key; (2) do not run it with a wallet that holds real funds unless you trust the code and/or audit it; (3) verify the default server URL (VECTOR_SPHERE_SERVER) and consider overriding to a known endpoint; (4) prefer using a wallet with minimal funds or a testnet account while evaluating; (5) be aware the skill sends signed requests to the configured server (it does not directly transmit your private key, but signing and network calls occur). If you are not comfortable with the above or cannot audit the code, treat the skill as untrusted.

Type: OpenClaw Skill Name: unimarket Version: 0.1.6 The OpenClaw AgentSkills skill bundle 'unimarket' appears benign. The `SKILL.md` file includes explicit instructions to the AI agent to prevent prompt injection from external contacts, which is a strong positive security indicator. The code primarily interacts with a P2P marketplace API (`https://market-api.unicity.network`) and accesses the agent's wallet (`~/.openclaw/unicity/mnemonic.txt`) for identity and signing, which is necessary for its stated purpose. While the use of user-provided strings in API paths (e.g., `intentId` in `scripts/intent.ts`) could be a vector for backend vulnerabilities if not properly sanitized by the server, there is no clear evidence of intentional malicious behavior, data exfiltration to unauthorized endpoints, or attempts to establish persistence or backdoors within the skill's code.