Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Agnic Search for Service

v2.0.2

Search the x402 bazaar for paid API services. Use when the user wants to find APIs, discover services, browse the marketplace, or needs an external service....

0· 103·0 current·0 all-time
byAgnic.AI@agnicpay-prog

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for agnicpay-prog/agnicpay-search-for-service.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Agnic Search for Service" (agnicpay-prog/agnicpay-search-for-service) from ClawHub.
Skill page: https://clawhub.ai/agnicpay-prog/agnicpay-search-for-service
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install agnicpay-search-for-service

ClawHub CLI

Package manager switcher

npx clawhub@latest install agnicpay-search-for-service
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (search the x402 bazaar) align with the runtime instructions: the SKILL.md describes searching, listing, and inspecting paid API endpoints using the agnic CLI.
Instruction Scope
Instructions explicitly tell the agent to run `npx agnic@latest x402 ...` and to auto-detect payment requirements by trying HTTP methods until a 402 response is found. That behavior matches the stated goal but implies the agent will make direct requests to arbitrary URLs and may attempt multiple HTTP methods — potentially noisy or surprising.
!
Install Mechanism
There is no install spec, but the allowed-tools require running `npx agnic@latest`, which fetches and executes remote npm package code at runtime. npx execution of a remote package is inherent to the skill flow but is a higher-risk install/execution mechanism because it runs unreviewed code from the network.
Credentials
The skill declares no required environment variables or credentials, which is consistent with the SKILL.md statement that search/list/details do not need authentication. The only local state referenced is a cache path (~/.config/agnic/bazaar/), which is reasonable for the described functionality.
Persistence & Privilege
always:false and disable-model-invocation:false (default) — the skill can be invoked autonomously. Combined with the ability to run npx and probe external URLs, this increases potential blast radius if the skill is allowed to run without review, but the skill does not request permanent/always-on inclusion.
What to consider before installing
This skill does what it says (search and inspect x402 bazaar services) but it works by running `npx agnic@latest` on-demand and by sending requests to arbitrary endpoints (including trying multiple HTTP methods to detect 402 responses). Before installing or invoking it: 1) review the agnic package source on npm/GitHub and verify the maintainer/trustworthiness; 2) consider running it in a sandboxed/containerized environment or with egress controls so remote package code can't access sensitive local resources or exfiltrate data; 3) be aware it will write/cache data to ~/.config/agnic/bazaar/ and may generate multiple network requests to user-supplied URLs (no credentials required); 4) if you need stricter guarantees, request an install spec or a pinned package version (not `@latest`) and/or an auditable vendored implementation instead of npx execution.

Like a lobster shell, security has layers — review code before you run it.

latestvk9715cagac9nn4d8cpvz6d6g0985dbw7
103downloads
0stars
2versions
Updated 5d ago
v2.0.2
MIT-0

Searching the x402 Bazaar

Use npx agnic@latest x402 commands to discover and inspect paid API endpoints on the x402 bazaar marketplace. No authentication or balance is required for searching.

Commands

Search the Bazaar

Find paid services by keyword using BM25 relevance search:

npx agnic@latest x402 bazaar search <query> [-k <n>] [--force-refresh] [--json]
OptionDescription
-k, --top <n>Number of results (default: 5)
--force-refreshRe-fetch resource index from CDP API
--jsonOutput as JSON

Results are cached locally at ~/.config/agnic/bazaar/ and auto-refresh after 12 hours.

List Bazaar Resources

Browse all available resources:

npx agnic@latest x402 bazaar list [--network <network>] [--full] [--json]
OptionDescription
--network <name>Filter by network (base, base-sepolia)
--fullShow complete details including schemas
--jsonOutput as JSON

Discover Payment Requirements

Inspect an endpoint's x402 payment requirements without paying:

npx agnic@latest x402 details <url> [--json]

Auto-detects the correct HTTP method by trying each until it gets a 402 response, then displays price, accepted payment schemes, network, and input/output schemas.

Examples

# Search for weather-related paid APIs
npx agnic@latest x402 bazaar search "weather" --json

# Search with more results
npx agnic@latest x402 bazaar search "sentiment analysis" -k 10 --json

# Browse all bazaar resources
npx agnic@latest x402 bazaar list --full --json

# Check what an endpoint costs
npx agnic@latest x402 details https://example.com/api/weather

Prerequisites

  • No authentication needed for search, list, or details commands

Next Steps

Once you've found a service, use the pay-for-service skill to make a paid request.

Error Handling

Common errors:

  • "CDP API returned 429" -- Rate limited; cached data will be used if available
  • "No X402 payment requirements found" -- URL may not be an x402 endpoint
  • No results -- Try broadening the search query or using different keywords

Comments

Loading comments...