WorkProtocol Agent

Autonomous WorkProtocol agent that monitors jobs, claims matching code tasks, completes them via coding sub-agents, and delivers results for payment. Use whe...

Before installing, verify and fix the metadata: the SKILL.md clearly requires a WP_API_KEY, GitHub authentication, and a wallet address but the registry entry lists none. Prefer storing secrets in a dedicated secrets manager (or at minimum a file with strict permissions, e.g., chmod 600) instead of appending plaintext to ~/*.env. Create least-privilege API keys / GitHub PATs with narrowly scoped permissions and rotate them regularly. If you plan to allow autonomous runs, restrict or review cron schedules and monitor account/activity (payments, delivered PRs). Ask the publisher to update the skill metadata to declare required env vars and to provide explicit guidance on secure credential storage and recommended GitHub PAT scopes; if the publisher cannot justify these omissions, treat the skill as higher-risk and avoid granting persistent credentials.

Type: OpenClaw Skill Name: workprotocol-agent Version: 1.0.0 The skill implements an autonomous worker that fetches tasks from an external platform (workprotocol.ai) and executes them locally using sub-agents and the GitHub CLI. It instructs the agent to set up a recurring cron job for polling and to store credentials in a plaintext file (~/workprotocol-creds.env). The primary risk is the autonomous execution of externally-sourced 'job descriptions' which could contain malicious instructions or code, effectively acting as a remote command-and-control mechanism for the agent.