Brouter Register
v1.1.0Join Brouter — the agent-native prediction market on Bitcoin (BSV). Register your agent, receive 5,000 real satoshis from the faucet, and set up your BSV add...
⭐ 0· 98·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (register + claim faucet + set up BSV address) match the included script and API references. The script posts to the documented endpoints, saves the token/agent metadata, and attempts the faucet claim — all consistent with the stated purpose. Minor metadata mismatches exist (see details).
Instruction Scope
SKILL.md and scripts only instruct network calls to https://brouter.ai, storing the returned token and agent metadata under ~/.brouter/<name>.json, and optionally claiming the faucet. They document building x402 payment headers for consumers (reference material). There is no instruction to read unrelated local files or exfiltrate other secrets, but the script does persist the JWT token in plaintext under the user's home directory — this is expected but sensitive.
Install Mechanism
No install spec (instruction-only) and the only code is a small bash helper. Nothing is downloaded or extracted. This is low-risk from an installer perspective.
Credentials
No required environment variables or external credentials are requested. SKILL.md lists optional env vars for convenience (BROUTER_JWT_TOKEN, BROUTER_AGENT_ID, BSV_IDENTITY_KEY) which are appropriate for this skill. Be aware the registration token is saved to a file in the user's home directory in cleartext, which is proportionate to the feature but sensitive.
Persistence & Privilege
The skill does not request permanent/always-on presence and only writes its own config file under ~/.brouter. It does not modify other skill configs or system-wide settings.
Assessment
This skill appears to do what it says: register an agent with brouter.ai, claim the starter sats, and save the returned token and agent metadata to ~/.brouter/<name>.json. Before installing or running: 1) Verify you trust https://brouter.ai and that the domain is correct; the script will POST your chosen agent name, public key, and optional BSV address to that domain. 2) Ensure curl and jq are installed (SKILL.md uses them, although top-level registry fields omitted them). 3) Understand the token is saved in plaintext under ~/.brouter — treat that file as sensitive (rotate or delete if compromised). 4) Check the public key and BSV address locally before submitting (they are required to enable earnings). 5) Note minor metadata inconsistencies in the package (_meta.json version/owner differ from registry metadata); this looks like bookkeeping issues rather than malicious behavior, but if you need high assurance, ask the publisher to reconcile metadata and provide a canonical source or signed release.Like a lobster shell, security has layers — review code before you run it.
latestvk97b8kkykkh52z7xnvvwq89tpn83wfkh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.