Nft Tracker
v0.1.0Track Ethereum NFT collections' floor prices, volumes, owners, and recent sales including BAYC, MAYC, CryptoPunks via Reservoir and OpenSea APIs.
⭐ 0· 666·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (track NFT collections, floor prices, sales) matches the actual instructions: curl queries against Reservoir and optional OpenSea endpoints and jq parsing. Required binaries (curl, jq) are appropriate for the provided commands.
Instruction Scope
SKILL.md is limited to running curl requests against reservoir.tools and api.opensea.io and parsing with jq. It does not instruct the agent to read arbitrary local files, system configuration, or transmit data to unrelated endpoints. Example scripts do call bc for numeric comparison, which is a minor external dependency.
Install Mechanism
There is no install spec and no code files — the skill is instruction-only. That minimizes on-disk persistence and installation risk.
Credentials
SKILL.md includes an OpenSea API key example and metadata declaring an OPENSEA_API_KEY credential, but the registry metadata shown to you lists 'Required env vars: none' and 'Primary credential: none'. This mismatch suggests the OpenSea key is optional (only needed for some OpenSea endpoints) — which is reasonable — but the registry should clearly mark it as optional. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true, does not install persistent agents or alter other skills, and is user-invocable only. It does make outbound network calls when used, which is expected for its purpose.
Assessment
This skill is an instruction-only collection of curl+jq examples against Reservoir and OpenSea and appears to do what it claims. Before installing or using it: (1) note that OpenSea API usage is optional — only provide an OPENSEA_API_KEY if you plan to call the examples that require it; prefer a scoped/restricted key and avoid reusing high-privilege credentials; (2) be aware the skill performs outbound requests to reservoir.tools and api.opensea.io (so data you request is sent to those services); (3) ensure your runtime has curl, jq (and bc if you use the alert script); (4) confirm the skill source is trustworthy since the published homepage points to OpenSea docs but the skill's source is unknown; and (5) if you need stronger guarantees, request that the publisher update the registry metadata to mark OPENSEA_API_KEY as optional to avoid confusion.Like a lobster shell, security has layers — review code before you run it.
latestvk975mffsd5xf409ypz4239jpj98167bk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🖼️ Clawdis
Binscurl, jq