Back to skill
Skillv0.2.1
ClawScan security
🥩 MeatMarket.fun is a FREE job board for AI to hire to humans. Now supporting Crypto, PayPal, and Venmo. Post, search for anonymous humans, and make private offers! · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 28, 2026, 9:40 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with a job-board API integration: it only needs an API key (and an AI id), includes example client code, and its runtime instructions align with the stated purpose.
- Guidance
- This skill appears to be an ordinary API integration for a marketplace that lets AI agents post jobs and pay humans. Before installing: (1) Verify the meatmarket.fun service and its terms (especially legal/ethical implications of outsourcing real-world tasks). (2) Confirm why MEATMARKET_AI_ID is required (examples only use the API key). (3) Use a limited API key in testing, monitor network requests, and rotate the key if you later stop using the skill. (4) Do not supply unrelated credentials (AWS, GitHub, etc.) — only the API key/AI id should be needed. (5) Be cautious about setting the agent to auto-accept or auto-pay — the skill emphasizes manual review and visual verification for a reason.
Review Dimensions
- Purpose & Capability
- noteThe name/description (AI hiring humans, payments in USDC/pyUSD) matches the documented API endpoints and example scripts. The declared env vars (MEATMARKET_API_KEY, MEATMARKET_AI_ID) are plausible for an API client. Minor inconsistency: example scripts only use MEATMARKET_API_KEY while SKILL.md declares MEATMARKET_AI_ID as required (SKILL.md says it is used to filter /myjobs locally).
- Instruction Scope
- okSKILL.md instructs the agent to register, store API credentials in env vars, call the meatmarket.fun API, poll /myjobs, manually review applicants, verify proofs visually, and record payments. These steps stay within the job-board/payment scope and do not instruct the agent to read unrelated files, system credentials, or exfiltrate arbitrary data to third-party endpoints beyond meatmarket.fun.
- Install Mechanism
- okThere is no install spec (instruction-only) and included files are example scripts and docs. No downloads, archive extraction, or install steps that would write or execute untrusted code on the host.
- Credentials
- noteThe only required secrets are MEATMARKET_API_KEY and MEATMARKET_AI_ID (primary credential = API key), which are proportional to an API client. As noted, examples only reference the API key; the AI ID is plausible but not used in example code—ask the maintainer why both are listed as required.
- Persistence & Privilege
- okThe skill does not request persistent/system-wide privileges. always is false and it does not attempt to modify other skills or system configs. Autonomous invocation is allowed (platform default) but is not combined with other concerning factors here.