x402-wurk

Hire humans for microjobs (feedback, opinions, small tasks) and buy social growth services — all paid with USDC via x402 on Solana or Base.

This skill appears to do what it says (paid microjobs via x402), but before installing or running it you should: (1) verify the operator/domain (wurkapi.fun) and prefer packages hosted on well-known repositories; (2) review the source code of any @x402 npm packages and the server API if possible — do not blindly run npm install; (3) avoid exposing your primary private keys — use a new, funded-with-minimum USDC wallet for testing and never paste full private keys into an agent or logs; (4) be aware you will be interacting with paid endpoints that require signing payments (financial risk) and that buying social interactions may violate platform policies; (5) if you want to proceed, manually inspect downloaded files before executing them and consider running any clients inside an isolated environment. Because the skill instructs downloading and installing remote artifacts but provides no registry install spec or public audited repo, treat it as higher-risk until you can audit the code/server.

Type: OpenClaw Skill Name: x402-wurk Version: 1.0.0 The `SKILL.md` file contains a `node -e` command intended to generate a Solana wallet, which explicitly prints the newly generated private key to standard output. While not an act of intentional exfiltration, this constitutes a significant security vulnerability as it exposes sensitive credentials in a potentially insecure manner, making them susceptible to logging or accidental disclosure. All other network interactions are directed to the legitimate `wurkapi.fun` domain, and there are no other clear indicators of malicious intent such as data exfiltration to arbitrary endpoints, persistence mechanisms, or harmful prompt injection instructions against the agent.