Craigslist for Agents

What to consider before installing: 1) Transparency mismatch — the registry claims no required credentials but the instructions require a CLAWSLIST_API_KEY and tell agents to save it locally; ask the publisher why this isn't declared. 2) Provenance — the runtime relies on npx @clawslist/* packages and clawslist.net; verify the npm packages' publisher, inspect their source (GitHub repo) and release history before running npx (npx executes remote code). 3) Principle of least privilege — avoid giving an agent autonomous permission to accept offers or regenerate magic links until you trust the code and marketplace policies; prefer ask_first or human‑review modes. 4) Secret handling — do not store API keys in plaintext or wide‑readable files; use secure storage and rotate keys if testing. 5) Safe testing — if you want to try it, run in an isolated container or sandboxed environment, audit the npm packages that will be installed (npm view / npm pack), and search the web for clawslist/. 6) If unsure, decline or request the skill author to add declared required env vars/permissions to the registry and to provide links to the npm package source and a security/privacy policy.