Wojak.ink - NFT Browser
v1.0.0Browse, search, analyze, and track Wojak Farmers Plot NFTs—view floor prices, rarity, price trends, traits, listings, and deal opportunities on the Chia bloc...
⭐ 1· 1.6k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The files (api client, rarity, history, traits, format, CLI) implement the documented NFT browsing, rarity estimation, listing queries, and local history features. Required capabilities (network access to MintGarden/Dexie, IPFS) match the stated purpose; no unrelated credentials or services are requested.
Instruction Scope
SKILL.md and cli.js instruct use of npm install, running the CLI and periodic 'track' runs. At runtime the code only performs network calls to MintGarden and Dexie, reads/writes JSON under the skill's data directory, and formats output. The docs mention a future 'collection scrape' to unlock full trait data — that would broaden scope if implemented, but current code uses only public APIs and local storage.
Install Mechanism
The registry provides no automated install spec; SKILL.md tells users to run 'npm install' and 'npm link'. That is a normal install path but means npm will fetch dependencies from the registry and could run package scripts. Users should inspect package.json and node_modules (postinstall scripts) before running. No remote download-from-arbitrary-URL install is present.
Credentials
The skill requests no environment variables, no credentials, and no system config paths. It only needs network access to public APIs and permission to create a data/ directory under the skill folder for JSON persistence — which is proportionate to its claim of local price history storage.
Persistence & Privilege
The skill persists data only to its own data directory (~/clawd/skills/wojak-ink/data by docs) and does not modify other skills or system-wide configs. always is false and the skill does not request elevated privileges. Autonomous invocation is allowed by default but not combined with any broad credential access.
Assessment
This skill appears to be what it says: an NFT browser/analytics tool that calls public MintGarden and Dexie APIs, loads images from an IPFS gateway, and stores price/sales history as JSON files in its own data/ folder. Before installing: 1) review package.json and any npm scripts (postinstall) to ensure no unexpected install-time actions; 2) be aware npm install will fetch dependencies from the public registry and could add executables to node_modules/.bin; 3) the skill writes price_history.json and sales.json under the skill directory — if you want to limit exposure, run it in a sandbox or container or change the data path; 4) the rarity estimation uses approximations and randomness until full metadata is scraped, so treat rarity scores as estimates; 5) if you see future updates that add a 'scrape full collection metadata' feature, review that change carefully because web scraping or broad crawling can increase network usage and scope. Overall the package is internally consistent and does not ask for secrets or unrelated access.Like a lobster shell, security has layers — review code before you run it.
latestvk97fhhma2t14tb2cxz4tvqsxm1804037
License
MIT-0
Free to use, modify, and redistribute. No attribution required.