Danube Tools Marketplace
v8.0.13Connect your AI agent to a growing marketplace of services and tools through a single API key — discover, search, and execute anything available
⭐ 0· 1.5k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description match the declared requirements: the skill only needs DANUBE_API_KEY and curl to discover and execute marketplace tools. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md instructs the agent to search broadly and execute arbitrary tools discovered in the marketplace (including batch executions). This is expected for a marketplace connector, but it grants the agent authority to call and pass data to external tools whose behavior and downstream network interactions depend on the selected tools. The instructions do not ask the agent to read unrelated files or environment variables.
Install Mechanism
No install spec or code is included (instruction-only). This minimizes on-disk risk; required binary is only curl, which is reasonable for the documented curl-based device flow examples.
Credentials
Only one env var (DANUBE_API_KEY) is required and is appropriate for the stated purpose. The skill documents that the key grants read/execute and user-scoped write (create/update/delete of the user's skills/workflows). That write scope is plausible but sensitive — it justifies caution (e.g., avoid granting to untrusted agents) because it allows modifications of user-scoped artifacts via the API key.
Persistence & Privilege
always: false and no special system-wide modifications are requested. The skill suggests adding an MCP server entry to agent config (normal for connectors) but does not ask to modify other skills or system-level credentials.
Assessment
This skill appears to do what it claims: connect your agent to a marketplace using a single DANUBE_API_KEY and curl. Before installing, consider: (1) Only grant the API key to agents you trust — the key allows executing tools and (user-scoped) creating/updating workflows. (2) Running marketplace tools can cause the agent to invoke third-party services or send data externally; review and approve which tools an agent may call, and avoid giving the agent unfettered autonomous invocation if you need tighter control. (3) Use least-privilege and rotate the API key if possible; monitor Danube dashboard audit logs for unexpected executions. (4) Verify the Danube service's trustworthiness (homepage/docs) if you don't already trust it. If you want extra safety, restrict the agent to user-invoked use only or require manual review of tool choices before execution.Like a lobster shell, security has layers — review code before you run it.
latestvk975es5qt5nfq8rt0qxdawa0xn84wqew
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binscurl
EnvDANUBE_API_KEY
Primary envDANUBE_API_KEY