Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Echo Developer Guide

v1.0.0

Build apps on AINative and earn revenue through the Echo Developer Program. Use when (1) Registering as a developer, (2) Setting markup rates (0-40%), (3) Ch...

0· 91·1 current·1 all-time
byToby Morning@urbantech

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for urbantech/echo-developer-guide.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Echo Developer Guide" (urbantech/echo-developer-guide) from ClawHub.
Skill page: https://clawhub.ai/urbantech/echo-developer-guide
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install echo-developer-guide

ClawHub CLI

Package manager switcher

npx clawhub@latest install echo-developer-guide
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (Echo Developer Program: register, set markup, check earnings, Stripe Connect payouts) aligns with the API endpoints and examples in SKILL.md. Nothing in the doc asks for unrelated resources or permissions.
Instruction Scope
Runtime instructions show concrete API calls to https://api.ainative.studio and Stripe Connect onboarding flows, which stay within the stated domain. However, all example requests use an Authorization: Bearer {jwt_token} header but the skill does not declare or explain where that token comes from or how it should be supplied/stored.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — lowest-risk delivery. It does not download or write code to disk.
Credentials
The SKILL.md expects an authenticated context (jwt_token) for API calls but the registry metadata lists no required environment variables or primary credential. This is an inconsistency: the skill needs an auth token to function but does not declare it. No unrelated credentials or broad secrets are requested.
Persistence & Privilege
always is false and there is no install or configuration that requests persistent system presence or modifies other skills. Autonomous invocation is allowed (platform default) but not combined with additional privileges.
What to consider before installing
This skill appears to be a straightforward developer guide for AINative's Echo program, but before installing or using it: (1) confirm the authenticity of the domain https://api.ainative.studio and that you trust the provider; (2) understand that you must supply a jwt_token (an authorization bearer token) for the example API calls — the skill fails to declare where that credential should come from or how to store it safely; (3) verify Stripe onboarding links at runtime (ensure they redirect to Stripe and not a phishing page); (4) ask the skill author to explicitly declare required environment variables/credential type and to document expected OAuth or JWT flows; (5) avoid pasting long-lived secrets into untrusted UIs — prefer short-lived tokens or follow documented OAuth flows. If you need higher assurance, request the skill author provide provenance (homepage, contact, or repository) and an explicit credential/installation section.

Like a lobster shell, security has layers — review code before you run it.

latestvk970y40vse09vn982vvjbfe1dd83haj1
91downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Echo Developer Program Guide

How It Works

  1. You build an app using AINative APIs
  2. Your customers use your app → they consume API credits
  3. You set a markup (0–40%) on top of AINative's cost
  4. AINative takes 5% platform fee
  5. You receive the rest via weekly Stripe Connect payouts

Example: Customer uses 1,000 credits at base cost $0.10. You set 30% markup → you earn $0.03, AINative takes $0.0015.

Register as a Developer

import requests

requests.post(
    "https://api.ainative.studio/api/v1/echo/register",
    headers={"Authorization": f"Bearer {jwt_token}"},
    json={"developer_name": "My App", "website": "https://myapp.com"}
)

Set Your Markup Rate

# Set 25% markup (range: 0.0 to 0.40)
requests.put(
    "https://api.ainative.studio/api/v1/echo/markup",
    headers={"Authorization": f"Bearer {jwt_token}"},
    json={"markup_rate": 0.25}
)

Check Earnings

earnings = requests.get(
    "https://api.ainative.studio/api/v1/echo/earnings",
    headers={"Authorization": f"Bearer {jwt_token}"}
).json()

print(f"Total earned: ${earnings['total_earnings']}")
print(f"This month: ${earnings['current_period_earnings']}")
print(f"Pending payout: ${earnings['pending_amount']}")

Connect Stripe for Payouts

# Start Stripe Connect onboarding
onboard = requests.post(
    "https://api.ainative.studio/api/v1/echo/connect/onboard",
    headers={"Authorization": f"Bearer {jwt_token}"}
).json()

# Redirect your user to:
print(onboard["onboarding_url"])  # Stripe Connect Express page

# Check status
status = requests.get(
    "https://api.ainative.studio/api/v1/echo/connect/status",
    headers={"Authorization": f"Bearer {jwt_token}"}
).json()
print(f"Payouts enabled: {status['payouts_enabled']}")

Request Manual Payout

# Minimum payout: $10
payout = requests.post(
    "https://api.ainative.studio/api/v1/echo/payout",
    headers={"Authorization": f"Bearer {jwt_token}"},
    json={"amount": 50.00}
).json()
print(f"Payout requested: ${payout['amount']}, ETA: {payout['estimated_arrival']}")

Auto-Payout Settings

# Enable weekly automatic payouts
requests.post(
    "https://api.ainative.studio/api/v1/echo/settings/auto",
    headers={"Authorization": f"Bearer {jwt_token}"},
    json={"enabled": True, "minimum_amount": 10.00, "schedule": "weekly"}
)

Earnings History

history = requests.get(
    "https://api.ainative.studio/api/v1/echo/earnings/history",
    headers={"Authorization": f"Bearer {jwt_token}"},
    params={"days": 30}
).json()

Echo API Endpoints

EndpointMethodDescription
/api/v1/echo/registerPOSTRegister as developer
/api/v1/echo/markupPUTSet markup rate (0-40%)
/api/v1/echo/earningsGETCurrent earnings summary
/api/v1/echo/earnings/historyGETEarnings over time
/api/v1/echo/earnings/breakdownGETBreakdown by app/customer
/api/v1/echo/payoutsGETList past payouts
/api/v1/echo/payoutPOSTRequest manual payout
/api/v1/echo/balanceGETAvailable payout balance
/api/v1/echo/connect/onboardPOSTStart Stripe Connect
/api/v1/echo/connect/statusGETCheck Stripe Connect status
/api/v1/echo/settings/autoGET/POSTAuto-payout settings

Key Concepts

  • Developers build their OWN apps — not upload models to AINative
  • Customers pay developers — developers bill customers using AINative pricing + markup
  • Weekly payouts via Stripe Connect Express, minimum $10
  • Platform fee 5% of developer earnings (deducted automatically)
  • Markup range 0% to 40% — set per developer account

References

  • src/backend/app/api/v1/endpoints/developer_earnings.py — 21 route handlers
  • src/backend/app/services/stripe_service.py — Stripe Connect integration
  • src/backend/app/tasks/developer_payouts.py — Weekly Celery payout tasks
  • docs/guides/DEVELOPER_PAYOUTS_GUIDE.md — Full payouts guide
  • docs/projects/ainative-developer-studio/guides/ECHO_DEVELOPER_GUIDE.md — External dev guide (1,283 lines)

Comments

Loading comments...