Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
BitSkins
v1.0.0Interacts with the BitSkins REST API V2 and WebSocket API for CS2/Dota 2 skin trading. Supports account management, market search, buying, selling, listing, delisting, relisting, price updates, Steam inventory/deposits/trades, wallet operations, and real-time WebSocket subscriptions. Use when the user wants to search for skins, check prices, buy or sell items, manage their BitSkins account, check balances, or interact with the BitSkins marketplace.
⭐ 0· 987·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md, reference docs, and helper script all align with a BitSkins marketplace integration (market search, buy/sell, wallet, Steam interactions, WebSocket subscriptions). However the registry metadata lists no required environment variables or credentials while the SKILL.md and the shipped script require BITSKINS_API_KEY; that mismatch is incoherent and should be corrected. The skill has no homepage/source URL, so provenance is unknown.
Instruction Scope
Runtime instructions are narrowly scoped to calling BitSkins endpoints and WebSocket channels and correctly warn to confirm financial operations and request fresh 2FA codes. However the instructions reference an environment variable (BITSKINS_API_KEY) and rely on curl/jq, yet the registry did not declare these requirements — the SKILL.md and script expect secrets and binaries that were not advertised, which is scope/inventory mismatch.
Install Mechanism
There is no install spec (instruction-only with a small helper script). This is low-risk from an install/download standpoint — nothing is fetched from arbitrary URLs or written to disk by an installer.
Credentials
The only credential required by the script is a BitSkins API key (appropriate for this integration), which is proportionate to the stated purpose. But the registry metadata failed to declare it (and the 'Required env vars' earlier shows none). The skill also implicitly requires curl (and optionally jq) but did not declare required binaries — an omission that affects security review and user expectations.
Persistence & Privilege
The skill does not request persistent privileges, 'always' is false, it does not modify system or other skill configs, and it does not demand persistent background access. Normal autonomous invocation is allowed (platform default).
What to consider before installing
This skill mostly does what it says (wraps the BitSkins REST and WebSocket APIs), but there are a few red flags you should address before using it with real funds or account keys:
- Provenance: the package has no homepage or source URL. Ask the publisher for the code origin or prefer a skill published by a known/verified author.
- Declared vs. actual requirements: the registry metadata lists no required env vars or binaries, but SKILL.md and scripts require BITSKINS_API_KEY and depend on curl (and optionally jq). Do not set an API key until the metadata is corrected.
- Secrets handling: the helper script sends your API key in the x-apikey header; ensure your platform stores the key in a secure secret store (not a global shell profile). Prefer creating a scoped/ephemeral API key on BitSkins with minimal permissions for testing.
- Test-read only first: start by calling non-destructive endpoints (e.g., GET /config/status/get or market search) to confirm behavior before attempting buys, withdrawals, or wallet operations.
- Verify binaries and environment: confirm curl is available (the script will fail otherwise) and jq is present if you want pretty output. Ask the author to list these in the skill metadata so automated checks can validate runtime prerequisites.
- Confirm 2FA workflow: the skill correctly requests fresh 2FA codes for sensitive endpoints — never allow the skill to store persistent 2FA codes.
- Ask for an updated package: request that the publisher update registry metadata to declare BITSKINS_API_KEY as required, list required binaries, and provide a homepage or source repository. If they cannot or will not, treat the skill as untrusted.
If you decide to proceed temporarily, use an account with no balance or an API key with limited permissions, and avoid any real financial or withdrawal actions until provenance and metadata are fixed.Like a lobster shell, security has layers — review code before you run it.
latestvk973dsr6q2m7yhy63ysyyept2580rec8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.