x402janus-acp

ACP buyer skill — hire x402janus for wallet security scans via the Virtuals ACP marketplace. Creates a job on the ACP marketplace targeting the x402janus age...

This skill appears to do exactly what it says: create ACP jobs targeting x402janus and return scan deliverables, and it only requires your ACP API key. Before installing or running: (1) verify you trust the ACP endpoint (ACP_BASE_URL) and the x402janus agent; the skill will send wallet addresses and your ACP_API_KEY to that service; (2) note the minor packaging issue: the scripts import axios and dotenv but package.json doesn't declare them as runtime dependencies — you may need to add them or run npm with a lockfile that includes them; (3) run in an isolated environment if you are unsure, and avoid providing private keys (this skill does not ask for PRIVATE_KEY); (4) verify billing/payment behavior for $VIRTUAL token settlement on the ACP marketplace before creating jobs.

Type: OpenClaw Skill Name: x402janus-acp Version: 2.0.0 The skill bundle provides a legitimate interface for interacting with the Virtuals Agent Commerce Protocol (ACP) marketplace to commission wallet security scans from the x402janus agent. The scripts, list-offerings.ts and scan-wallet-acp.ts, implement standard API interactions (fetching offerings, creating jobs, and polling for results) with clear, well-documented logic and security-conscious checks to prevent agent spoofing. While the package.json is missing the axios and dotenv dependencies required by the scan script, this appears to be an unintentional packaging error rather than a sign of malice, and no indicators of data exfiltration or prompt injection were found.