ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

FiberAgent

v1.0.1

Search 50,000+ merchants for products with cryptocurrency cashback, calculate effective prices, and provide affiliate links earning crypto rewards on Monad b...

⭐ 0· 451·0 current·0 all-time
by@openclawlaurent
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description match the delivered functionality: the skill wraps calls to https://fiberagent.shop to search products, register an agent, and fetch stats. It does not request unrelated credentials or binaries. One minor note: the README suggests adding your agentId/wallet to ~/.openclaw/openclaw.json (a user config path) — that is a recommended configuration step, not a hidden requirement.
ℹ
Instruction Scope
SKILL.md instructs the agent to send user search keywords and agent_id/wallet address to fiberagent.shop endpoints (search, register, stats, MCP). This is expected for a shopping/affiliate skill, but it means user queries and the wallet address will be transmitted to an external service; the instructions do not attempt to read local secrets or unrelated files.
✓
Install Mechanism
There is no automated install spec (instruction-only install). The README gives local install instructions (copy skill into ~/.openclaw/workspace/skills) which is normal for OpenClaw. No remote downloads or archive extraction are performed by the skill itself.
✓
Credentials
The skill declares no required environment variables or credentials. It asks the user to provide an agent ID and wallet address for registration/earnings, which is proportional to its affiliate payment purpose. It does not request private keys or unrelated tokens; however, storing a wallet address in a config file is recommended in docs and users should avoid storing private keys or secrets there.
✓
Persistence & Privilege
always:false and the skill does not request elevated platform privileges. The README suggests enabling the skill in the user's OpenClaw config but does not attempt to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but that is appropriate for this kind of tool.
Assessment
This skill appears to do what it says: it forwards user search queries and an agent/wallet identifier to fiberagent.shop and returns affiliate links with crypto cashback. Before installing: (1) confirm you trust https://fiberagent.shop and its operator (review the linked GitHub repo and site), (2) do not provide private keys or other secrets — only supply a public wallet address for earnings, (3) be aware that user queries will be sent to an external service (privacy consideration), and (4) if you want to limit exposure, use a dedicated or throwaway wallet address for agent earnings and avoid storing sensitive secrets in your OpenClaw config file.

Like a lobster shell, security has layers — review code before you run it.

agent-commercevk97ecfq5xrb4m29bb5c7sd7s2d81qjs7cashbackvk97ecfq5xrb4m29bb5c7sd7s2d81qjs7cryptovk97ecfq5xrb4m29bb5c7sd7s2d81qjs7dealsvk97ecfq5xrb4m29bb5c7sd7s2d81qjs7erc-8004vk97ecfq5xrb4m29bb5c7sd7s2d81qjs7latestvk97ecfq5xrb4m29bb5c7sd7s2d81qjs7monadvk97ecfq5xrb4m29bb5c7sd7s2d81qjs7shoppingvk97ecfq5xrb4m29bb5c7sd7s2d81qjs7wildfirevk97ecfq5xrb4m29bb5c7sd7s2d81qjs7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments