Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ampere marketplace
v1.0.0Ampere AI Agent Marketplace for OpenClaw. Browse and install free & paid agents across developer tools, automation, research, content, and more.
⭐ 0· 48·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, the optional AMPERE_API_KEY, and the listed API endpoints are coherent: a marketplace that lists agents and provides download URLs legitimately needs a download API and (for paid content) an API key.
Instruction Scope
SKILL.md keeps scope focused on browsing and installing agents and explicitly requires user consent and a preview of SKILL.md before writing to disk. It instructs use of the live API endpoints (https://api.agentplace.sh) and to download agent ZIPs and extract them into ~/.openclaw/workspace/skills/. It does not instruct the agent to execute downloaded code, but it also does not require verifying archive integrity or listing/examining archive contents beyond previewing the SKILL.md.
Install Mechanism
There is no install spec (instruction-only), but the provided install flow downloads arbitrary ZIP files and unzips them into the user's skills directory. The flow uses a custom domain (api.agentplace.sh) and performs extract operations without recommending signature/checksum verification or sandboxing — this is a common vector for introducing malicious files even if the skill itself does not auto-run them.
Credentials
No required environment variables; AMPERE_API_KEY is optional and clearly tied to the 'paid' tier. The requested credentials are proportional to the described functionality and are limited in scope in the documentation.
Persistence & Privilege
The skill is not always-enabled, does not request broad system privileges, and only writes into the user's OpenClaw skills workspace per the instructions. That behavior is expected for a marketplace skill, though writing files to the home workspace is inherently persistent and should be treated carefully.
What to consider before installing
This skill appears to do what it claims — let you browse and download agent ZIPs — but it asks you to download and extract archives from a third-party API without recommending signature or checksum verification. Before installing agents from Ampere: 1) Always preview the included SKILL.md and inspect the ZIP contents (e.g., curl -sL "$url" -o /tmp/agent.zip; unzip -l /tmp/agent.zip) to check for unexpected executables or scripts. 2) Prefer installing first into an isolated directory (not directly into your main skills folder) and don't run any included install scripts unless you trust the author. 3) For paid agents, only use your AMPERE_API_KEY with the stated domain and never paste other secrets. 4) If you rely on stronger safety, ask Ampere for signatures or checksums for agent archives or only install agents from authors you trust. Given these gaps, proceed cautiously — verify archive contents and provenance before extracting into your active skills workspace.Like a lobster shell, security has layers — review code before you run it.
latestvk97cdt20ktae82qtwc2wm0jpbd83vrnh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.