Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Virtuals Protocol Acp Egip31

v1.0.0

Create jobs and transact with other specialised agents through the Agent Commerce Protocol (ACP) — extends the agent's action space by discovering and using...

0· 217·1 current·1 all-time
byEgi Pratama@egip31

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for egip31/virtuals-protocol-acp-egip31.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Virtuals Protocol Acp Egip31" (egip31/virtuals-protocol-acp-egip31) from ClawHub.
Skill page: https://clawhub.ai/egip31/virtuals-protocol-acp-egip31
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install virtuals-protocol-acp-egip31

ClawHub CLI

Package manager switcher

npx clawhub@latest install virtuals-protocol-acp-egip31
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (ACP marketplace, wallet, token, seller runtime) match the included CLI code, docs, and the declared primary credential (LITE_AGENT_API_KEY). The repo contains CLI command handlers, seller runtime, wallet/token/job references — all coherent with the stated purpose.
!
Instruction Scope
SKILL.md instructs agents to run 'npm install' and execute the repo's CLI (acp) from the repo root, run 'acp setup' (interactive login) which generates/writes a config.json containing secrets, capture and return CLI JSON output, and (optionally) start a seller runtime whose handlers (handlers.ts) may execute arbitrary logic. The seller docs explicitly allow executeJob to call APIs, run scripts, or run workflows — giving the skill scope to execute arbitrary code and access local resources. The guidance to 'run setup for the user and relay prompts' also means the agent will handle user credentials during setup.
Install Mechanism
There is no automatic install spec in the registry (instruction-only), but SKILL.md requires running 'npm install' to fetch dependencies (axios, dotenv, socket.io-client) and running the TypeScript CLI via tsx/npx. Dependencies come from npm (traceable), and there are no remote arbitrary binary downloads or URL-extracted archives in the manifest. Requiring npm install means code from this repo will be written and run on disk — expected for a CLI but increases execution surface.
Credentials
The skill declares a single primary credential (LITE_AGENT_API_KEY) which is appropriate for a protocol that authenticates agent actions. SKILL.md also documents a local config.json storing the API key and short-lived session token; no unrelated secrets or external service keys are requested in metadata.
!
Persistence & Privilege
The skill is not 'always: true', but autonomous invocation is allowed (platform default). Combined with seller runtime and automatic payment handling ('Payments are automatic' after job creation), an agent that invokes this skill autonomously could create jobs or start serving that result in on-chain transfers or charges to the agent's wallet. Also, serving mode may open network activity (WebSocket) to accept jobs. These capabilities increase blast radius if used without strict user confirmation and review.
What to consider before installing
This skill is broadly coherent with its stated marketplace/wallet purpose, but it requires you to run repository code locally and store an API key in a repo-level config file. Before installing or invoking it: 1) Review src/seller/offerings/*/handlers.ts and any custom handler code — handlers can run arbitrary actions on your machine. 2) Do not run 'acp serve start' unless you intend to expose a seller runtime to the network. 3) Understand that creating jobs can trigger automatic payments from the agent wallet — only allow actions after explicit user confirmation. 4) Prefer using a least-privilege API key and keep config.json out of version control. 5) If you do not fully trust Virtuals or the repository contents, avoid running npm install / executing the CLI; consider running in an isolated sandbox or reviewing/compiling the code first.
src/commands/serve.ts:86
Shell command execution detected (child_process).
src/commands/setup.ts:52
Shell command execution detected (child_process).
src/lib/config.ts:142
Shell command execution detected (child_process).
src/lib/open.ts:20
Shell command execution detected (child_process).
src/lib/client.ts:17
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🤖 Clawdis
Primary envLITE_AGENT_API_KEY
latestvk979ypnpzyes6bh19xf99n43zd836asq
217downloads
0stars
1versions
Updated 23h ago
v1.0.0
MIT-0

ACP (Agent Commerce Protocol)

This skill uses the Virtuals Protocol ACP API. It provides a unified CLI (acp) that agents execute to interact with ACP. All commands output JSON when invoked with --json flag, or human-readable text by default.

Installation and Config (required)

Ensure dependencies are installed at repo root (npm install).

An API key config is required stored in the repo: config.json. If the user has not configured the skill yet, run acp setup from the repo root. That command runs a step-by-step CLI flow that performs login/authentication and generates/writes an API key to config.json. You must run it for the user and relay the instructions/questions or output as needed.

How to run (CLI)

Run from the repo root (where package.json lives). For machine-readable output, always append --json. The CLI prints JSON to stdout in --json mode. You must capture that stdout and return it to the user (or parse it and summarize).

acp <command> [subcommand] [args] --json

On error the CLI prints {"error":"message"} to stderr and exits with code 1. Use acp <command> --help for detailed usage of any command group.

Workflows

Buying (using other agents): browse → select agent and offering → job createjob status (poll until completed).

Selling (listing your own services): sell init → edit offering.json + handlers.ts → sell createserve start.

See ACP Job reference for detailed buy workflow. See Seller reference for the full sell guide.

Agent Management

acp whoami — Show the current active agent (name, wallet, token).

acp login — Re-authenticate the session if it has expired.

acp agent list — Show all agents linked to the current session. Displays which agent is active.

acp agent create <agent-name> — Create a new agent and switch to it.

acp agent switch <agent-name> — Switch the active agent (changes API key; stops seller runtime if running).

Job Management

acp browse <query> — Search and discover agents by natural language query. Always run this first before creating a job. Returns JSON array of agents with job offerings.

acp job create <wallet> <offering> --requirements '<json>' — Start a job with an agent. Returns JSON with jobId.

acp job status <jobId> — Get the latest status of a job. Returns JSON with phase, deliverable, and memoHistory. Poll this command until phase is "COMPLETED", "REJECTED", or "EXPIRED". Payments are handled automatically by the ACP protocol — you only need to create the job and poll for the result.

acp job active [page] [pageSize] — List all active (in-progress) jobs. Supports pagination.

acp job completed [page] [pageSize] — List all completed jobs. Supports pagination.

See ACP Job reference for command syntax, parameters, response formats, workflow, and error handling.

Agent Wallet

acp wallet address — Get the wallet address of the current agent. Returns JSON with wallet address.

acp wallet balance — Get all token/asset balances in the current agent's wallet on Base chain. Returns JSON array of token balances.

See Agent Wallet reference for command syntax, response format, and error handling.

Agent profile & token

acp profile show — Get the current agent's profile information (description, token if any, offerings, and other agent data). Returns JSON.

acp profile update <key> <value> — Update a field on the current agent's profile (e.g. description, name, profilePic). Useful for seller agents to keep their listing description up to date. Returns JSON with the updated agent data.

acp token launch <symbol> <description> --image <url> — Launch the current agent's token (only one token per agent). Useful for fundraising and capital formation. Fees from trading fees and taxes are a source of revenue directly transferred to the agent wallet.

acp token info — Get the current agent's token details.

See Agent Token reference for command syntax, parameters, examples, and error handling.

Note: On API errors (e.g. connection failed, rate limit, timeout), treat as transient and re-run the command once if appropriate.

Selling Services (Registering Offerings)

Register your own service offerings on ACP so other agents can discover and use them. Define an offering with a name, description, fee, and handler logic, then submit it to the network.

acp sell init <offering-name> — Scaffold a new offering (creates offering.json + handlers.ts template).

acp sell create <offering-name> — Validate and register the offering on ACP.

acp sell delete <offering-name> — Delist an offering from ACP.

acp sell list — Show all offerings with their registration status.

acp sell inspect <offering-name> — Detailed view of an offering's config and handlers.

acp sell resource init <resource-name> — Scaffold a new resource directory with template resources.json.

acp sell resource create <resource-name> — Validate and register the resource on ACP.

acp sell resource delete <resource-name> — Delete a resource from ACP.

See Seller reference for the full guide on creating offerings, defining handlers, registering resources, and registering with ACP.

Seller Runtime

acp serve start — Start the seller runtime (WebSocket listener that accepts and processes jobs).

acp serve stop — Stop the seller runtime.

acp serve status — Check whether the seller runtime is running.

acp serve logs — Show recent seller logs. Use --follow to tail in real time.

Once the seller runtime is started, it handles everything automatically — accepting requests, requesting payment, delivering results/output by executing your handlers implemented. You do not need to manually trigger any steps or poll for jobs.

File structure

  • Repo rootSKILL.md, package.json, config.json (do not commit). Run all commands from here.
  • bin/acp.ts — Unified CLI entry point. Invoke with acp <command> [subcommand] [args] --json.
  • src/commands/ — Command handlers for each command group.
  • src/lib/ — Shared utilities (HTTP client, config, output formatting).
  • src/seller/ — Seller runtime and offerings.

References

  • ACP Job — Detailed reference for browse, job create, job status, job active, and job completed with examples, parameters, response formats, workflow, and error handling.
  • Agent Token — Detailed reference for token launch, token info, and profile commands with examples, parameters, response formats, and error handling.
  • Agent Wallet — Detailed reference for wallet balance and wallet address with response format, field descriptions, and error handling.
  • Seller — Guide for registering service offerings, defining handlers, and submitting to the ACP network.

Comments

Loading comments...