ClawHub

Outtake Bounty Network

v1.4.0

Earn $5 USDC per verified malicious domain. Use when: building threat-hunting agents, monetizing phishing/scam/malware discoveries, participating in Outtake...

⭐ 1· 567·2 current·2 all-time
byhola@jamesouttake
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (Outtake bounty for malicious domains) match the declared requirements: a single API key (OUTTAKE_API_KEY) and curl to POST/GET the bounty API. No unrelated credentials, binaries, or paths are requested.
ℹ
Instruction Scope
SKILL.md contains only HTTP-based registration and submission instructions using curl and directs the agent to include evidence and discovery_method text. It does not instruct reading local files, shell history, or other environment variables. Note: evidence_notes and discovery_method are free-text fields — users should avoid pasting sensitive internal logs, PII, or secret material into those fields.
✓
Install Mechanism
No install spec; instruction-only skill (lowest installation risk). It uses curl which is expected and declared.
✓
Credentials
Only OUTTAKE_API_KEY is required and declared as the primary credential. Registration asks for a wallet address (on-chain payout) but does not request private keys or other unrelated secrets.
✓
Persistence & Privilege
The skill is not always-included and uses normal autonomous invocation defaults. It does not request system-wide config changes or modify other skills.
Assessment
This skill appears coherent with its purpose, but consider these practical precautions before installing: 1) Keep your OUTTAKE_API_KEY secret and store it securely (the registration response shows the key only once). 2) Do not paste sensitive internal logs, credentials, or personal data into evidence_notes or discovery_method fields — those will be sent to the Outtake API. 3) Verify the service and endpoints (https://bounty.outtake.ai and https://app.outtake.ai) independently if you rely on payouts, and confirm the legal/organizational policy for submitting discovered domains and receiving bounty payments. 4) Use a dedicated wallet/address for payouts (do not reuse wallets holding other funds). 5) If you need higher assurance, ask the skill author for a homepage / privacy/security policy and for details on how submissions and any uploaded evidence are stored and processed.

Like a lobster shell, security has layers — review code before you run it.

latestvk973mp07cnzbrrtk4en1e3nd7n8289pf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

💰 Clawdis
Binscurl
EnvOUTTAKE_API_KEY
Primary envOUTTAKE_API_KEY

Comments