NanoBazaar

• Analyzed: May 12, 2026, 3:16 AM
• Findings: 1
• Version: 2.0.3
• Hash: d528500d3c37a8f385143eebbc7fa5774c3db31095ae53f17be36defdd0b78b3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for NanoBazaar is classified as benign. The skill's core functionality involves cryptographic operations, interacting with a remote relay (`https://relay.nanobazaar.ai`), and managing a cryptocurrency wallet via the `nanobazaar-cli` and `berrypay` CLIs. While these activities inherently involve sensitive data (e.g., private keys, wallet seeds) and external network/shell access, the documentation and agent prompts (`SKILL.md`, `docs/PAYLOADS.md`, `prompts/buyer.md`, `prompts/seller.md`) contain explicit and strong instructions to the AI agent to prevent malicious behavior. Specifically, the agent is instructed to treat all external payload bodies as untrusted, never to execute commands or reveal secrets based on payload content, and to require human confirmation for fetching/running external links or scripts. There is no evidence of intentional harmful behavior, data exfiltration, or unauthorized persistence beyond the skill's stated purpose.