ClawHub

Compute Market

v1.0.0

Access decentralized GPU compute market for stats, providers, registration, task submission, and status tracking with both free and paid plans.

⭐ 0· 46·1 current·1 all-time
by张律师@sealawyer2026
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (decentralized GPU compute market) match the code and runtime behavior. The package provides a local CLI wrapper (wrapper.py, main.py/market.py) and contacts an external API (token-master domains) for stats, providers, registration and task submission — exactly the advertised functionality.
ℹ
Instruction Scope
SKILL.md shows CLI examples and public API endpoints, and the wrapper.py performs only the advertised HTTP calls (/api/stats, /api/providers, /api/tasks and POSTs to create providers/tasks). Nothing in the SKILL.md or code instructs reading unrelated local secrets. Minor inconsistency: SKILL.md lists API base path '/api/v1' while wrapper.py calls '/api/...', which suggests a version/path mismatch to verify before use.
ℹ
Install Mechanism
Registry metadata lists no install spec but a shipped install.sh exists which copies wrapper.py to ~/.local/bin/compute-market and installs the requests package via pip. The install script writes to the user home bin (expected), and dependencies are minimal. No high-risk remote archive downloads or obscure URLs are used in the installer.
✓
Credentials
The skill requests no environment variables or credentials. Network calls are to the service domains listed in manifest/SKILL.md; the wrapper uses a fixed 'cli_user' identifier when POSTing. There are no requests for unrelated cloud credentials or secrets.
✓
Persistence & Privilege
always: false and no special persistence or system-wide configuration changes beyond installing a user-level executable (~/.local/bin). The skill does not modify other skills or agent configs.
Assessment
What to consider before installing: - This skill will contact remote servers (http://compute.token-master.cn and a backup at http://compute.token-master.ai). Only install/run it if you trust those domains. Network activity is expected for this skill and not a hidden behavior. - The provided install.sh will copy the CLI to ~/.local/bin/compute-market and attempt to pip-install the requests library. Inspect install.sh and wrapper.py yourself before running; you can run the code without installing by invoking wrapper.py directly (python3 wrapper.py ...). - SKILL.md declares API base '/api/v1' but the wrapper uses '/api/...'. Confirm the remote API paths and behavior before submitting any sensitive data or expensive jobs. - No credentials are requested, but POST operations include a fixed user_id ('cli_user'). If you will submit tasks that include sensitive inputs, treat the remote service as untrusted until verified. - If unsure about the project's legitimacy, run it in an isolated environment (container or VM) or review network traffic/logs; check domain reputation and the GitHub/homepage references before giving it network access.

Like a lobster shell, security has layers — review code before you run it.

latestvk971q754vgkradswf7gppdecf583r2dr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments