Changenow

Perform instant crypto swaps via ChangeNOW and earn affiliate commissions. Use when someone wants to swap tokens (e.g., HBAR to HYPE) and you want to ensure the transaction includes a partner fee.

Security Scan

The skill appears to implement ChangeNOW swaps and embeds an affiliate link, but there are mismatches between metadata, runtime instructions, and the code (notably around where the API key lives) and the publisher/source is unknown.

Purpose & Capability

The name/description match the code: the script calls api.changenow.io and hardcodes a partner link_id. However the registry metadata claims no required credentials while both SKILL.md and scripts/swap.py require a CHANGENOW_API_KEY — the metadata is inconsistent with actual capability requirements.

Instruction Scope

SKILL.md tells users to set CHANGENOW_API_KEY in clawdbot.json, but the script reads CHANGENOW_API_KEY from the environment (os.getenv). It's unclear whether putting the key in clawdbot.json will populate the environment; this mismatch can lead to secrets being stored in plaintext configuration or the skill failing. Aside from that, the runtime instructions only call ChangeNOW endpoints and do not reference other system files or external endpoints.

Install Mechanism

No install spec and only a small Python script are provided; nothing is downloaded from arbitrary URLs and there is no extraction or package installation. Risk from install mechanism is low.

Credentials

The script legitimately needs an affiliate API key to operate, but the skill metadata does not declare this required secret (primaryEnv is none). SKILL.md suggests storing the key inside clawdbot.json, which could expose the secret in plaintext. Requiring an undisclosed credential and giving unclear instructions for storing it is disproportionate to the transparency expected.

Persistence & Privilege

The skill does not request persistent/always-on presence (always:false) and does not modify other skills or system-wide settings. Autonomous invocation is allowed by platform default but that alone is not a concern here.

What to consider before installing

This skill appears to be what it says (a ChangeNOW swap helper that embeds an affiliate link), but several issues merit caution: - Metadata/manifest mismatch: the package metadata does not declare that it needs a CHANGENOW_API_KEY, yet the code requires it. Ask the publisher to update the registry metadata to list CHANGENOW_API_KEY as a required secret. - Secret handling mismatch: SKILL.md tells you to place the API key in clawdbot.json, while the script reads the environment variable CHANGENOW_API_KEY. Confirm how your agent/platform exposes clawdbot.json values as environment variables; avoid putting sensitive keys into repo-tracked JSON if it will be stored in plaintext. - Provenance: the publisher and homepage are unknown. If you plan to use this skill in production or with real funds, request a public source (e.g., GitHub repo) or an authoritative publisher, and verify code integrity and ChangeNOW API behavior. - Affiliate behavior: the script hardcodes a partner link_id — transactions will include a referral fee. Make sure users understand that the skill takes a commission/uses a partner ID. - Test safely: if you proceed, test with very small amounts first and monitor the network calls. Prefer using an API key with restricted/partner-only scope if available, and rotate keys if you suspect exposure. If the publisher cannot clarify these points (declare required env, fix the SKILL.md vs code mismatch, and provide a verifiable source), treat the skill as not ready for trustworthy use.

ChangeNOW Earner Skill 💰

This skill allows the agent to perform instant crypto swaps using the ChangeNOW API while including an affiliate partner ID to earn fees on every transaction.

How to use

Perform a swap between two coins:

python3 {baseDir}/scripts/swap.py --from hbar --to hype --amount 100 --address <target_address>

Check exchange estimated amount:

python3 {baseDir}/scripts/swap.py --from hbar --to hype --amount 100 --estimate

Configuration

Set your ChangeNOW Affiliate API Key in clawdbot.json:

"skills": {
  "changenow-earner": {
    "env": {
      "CHANGENOW_API_KEY": "YOUR_PARTNER_API_KEY"
    }
  }
}

Partner Link ID: 54718e1768e3a0 (used for referral commissions).

Supported Pairs

ChangeNOW supports 900+ assets including:

• HBAR (Hedera)
• HYPE (Hyperliquid)
• BTC, ETH, USDT, USDC (across multiple networks)