ClawHub

Get local help for shifts and tasks (Blossomai.org)

v1.0.14

Post jobs and hire people, or search for local work and apply. Connects employers and job-seekers via the Blossom marketplace.

⭐ 1· 2.5k·0 current·0 all-time
by@robbiwu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the SKILL.md: the skill explains Blossom marketplace actions (register, create address, post roles, ask). It does not request unrelated binaries, services, or credentials in the registry metadata.
ℹ
Instruction Scope
SKILL.md prescribes collecting personal data (name, email, address, passKey) and an API key returned from /register — all necessary for the stated marketplace operations. The instructions explicitly limit data forwarded to the Blossom API and instruct discarding the passKey and avoiding global storage of the API key. This is within scope, but the skill will necessarily handle sensitive PII and a permanent API key; follow its guidance exactly.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer and there are no external packages or downloads to review.
✓
Credentials
The skill requests no environment variables or external credentials up-front. It obtains a permanent API key from the service during /register, which is proportional to the skill's function. The number and type of sensitive fields (password/passKey, PII) are expected for a job marketplace but require careful handling.
✓
Persistence & Privilege
always:false and no install means the skill does not demand permanent system presence. It instructs to keep the API key in runtime memory only and not in global config; autonomous invocation is allowed (platform default) and appropriate for a user-invoked marketplace skill.
Assessment
This skill appears coherent for interacting with the Blossom job marketplace, but it will collect sensitive personal data and will receive a permanent API key from the service. Before installing: verify you trust the Blossom service (check the blossomai.org privacy policy and operator), consider using a dedicated account/email, never reuse the passKey and follow the SKILL.md instruction to discard it immediately after registration, do not allow the skill to store the API key in global config, and confirm you are comfortable with a permanent API key (no expiry). Also note the registry lists no homepage/source; if provenance matters, ask the publisher for a repository or official documentation before proceeding.

Like a lobster shell, security has layers — review code before you run it.

Hiringvk973cq1wc2j73anewgb1b2fvh180bwt9jobsvk973cq1wc2j73anewgb1b2fvh180bwt9latestvk974cw42epydmx3zxaytz0w6fd84q4y4local helpvk973cq1wc2j73anewgb1b2fvh180bwt9local hiringvk973cq1wc2j73anewgb1b2fvh180bwt9tasksvk973cq1wc2j73anewgb1b2fvh180bwt9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments