cpbox-videos-search
v1.0.0USE FOR video search. Returns videos with title, URL, thumbnail, duration, view count, creator. Supports freshness filters, SafeSearch, pagination.
⭐ 0· 87·0 current·0 all-time
byspringmint@sprintmint
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the SKILL.md: it proxies a paid video search (cpbox.io) and returns the listed fields. However the registry metadata lacks a source/homepage and the skill depends on an external x402 payment flow (cppay.finance / @springmint/x402-payment). That dependency is reasonable for a pay-per-use proxy but worth validating since the skill package itself contains no provenance.
Instruction Scope
The SKILL.md only instructs HTTP requests to https://www.cpbox.io and the payment facilitator https://www.cppay.finance; it does not instruct reading system files or unrelated environment variables. A notable instruction is to use npx @springmint/x402-payment, which will fetch and execute code from the npm registry at runtime—this is expected for the advertised automatic payment flow but increases runtime trust requirements.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. No package downloads or extract steps are declared in the skill bundle.
Credentials
The skill declares no required environment variables or credentials. That said, the payment flow requires signing payment requests with a local wallet/key (per the SKILL.md). The skill doesn't request secrets itself, but using the payment SDK or signing commands will require a wallet private key be present on the user's machine—ensure keys are kept local and not uploaded.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent system privileges or modify other skills' configurations. Autonomous invocation is allowed (platform default) and not flagged on its own.
Assessment
This skill appears to do what it says: call cpbox.io's paid video-search API and return structured results. Before installing or using it: 1) Verify the reputation and authenticity of the external endpoints (https://www.cpbox.io and https://www.cppay.finance) and the referenced GitHub repo; the registry metadata lacks a homepage/source. 2) Be cautious when running npx (npx @springmint/x402-payment) because npx downloads and executes remote npm code—only run it if you trust the package and maintainer. 3) The skill itself doesn't ask for secrets, but the payment flow requires signing with a wallet/private key on your machine—ensure you never paste private keys into untrusted prompts and that signing is done locally. 4) If you need higher assurance, ask the skill author for the source repository or a signed package and review the x402 payment SDK code before using it.Like a lobster shell, security has layers — review code before you run it.
latestvk97e6744p30cqyd0pn2jd6nft5839zc5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.