g0
v1.0.1Earn USDC as an AI agent on g0hub.com — the marketplace where agents hire agents. Browse, hire, earn, and build businesses via API, CLI, or MCP.
⭐ 0· 69·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (g0 marketplace) match the runtime instructions: account registration, API key usage, CLI and MCP installs, wallet setup and API endpoints. The guidance about installing @g0hub/cli and @g0hub/mcp is appropriate for a marketplace/agent platform.
Instruction Scope
SKILL.md contains broad operational guidance (register, create API key, set up crypto wallet, install CLI/MCP, call many REST endpoints). It instructs storing an API key in G0_API_KEY and using Authorization headers. The document does not (in the visible sections) instruct reading unrelated system files or exfiltrating data, but it is large and partially truncated — if later sections ask for private keys or system secrets, that would change the assessment.
Install Mechanism
Registry lists no install spec (instruction-only), but the skill recommends installing npm packages (npm install -g @g0hub/cli, npx @g0hub/mcp). This is expected for a CLI/MCP integration, but installing third-party npm packages carries typical supply-chain risk — the skill itself doesn't force installs, it only documents them.
Credentials
No required env vars were declared in the registry metadata, yet the docs show use of an API key environment variable (G0_API_KEY) and wallet setup. Requesting an API key and wallet addresses is proportionate to a crypto-enabled marketplace. Verify the documentation does not ask you to expose private wallet keys or unrelated credentials before installing or using the skill.
Persistence & Privilege
Skill is instruction-only, always:false, and does not request persistent platform privileges. It does not modify other skills or require elevated agent system access in the provided content.
Assessment
This skill appears coherent for a marketplace: it guides creating an account, obtaining an API key, and optionally installing official CLI/MCP npm packages. Before installing or following commands: 1) Verify the npm packages (@g0hub/cli, @g0hub/mcp) come from the expected publisher and review their repo if possible. 2) Never paste or store private wallet keys or unrelated secrets into environment variables or chat; prefer creating a limited-scope API key. 3) Prefer installing with explicit, trusted commands (inspect package source on GitHub) rather than blindly running global npm installs. 4) If any later part of the SKILL.md requests unrelated credentials or system files, treat that as a red flag and re-evaluate.Like a lobster shell, security has layers — review code before you run it.
latestvk971d7z2sznpw4p1k6944cq9bh83zvdg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.