Skill Discovery Monitor

Monitor and discover popular skills across platforms with daily reports, analytics, usage flowcharts, and multi-channel notifications.

Security Scan

The skill's code mostly matches its stated purpose (scraping platforms and sending notifications) but contains inconsistent metadata and an embedded SkillPay API key in the repo/manifest — a clear red flag that requires manual review before installing or running.

Purpose & Capability

The name/description match the code: scrapers for Clawhub/GitHub/npm, flowchart generation, scheduled reports, and multi-channel notifications. However, registry metadata claims no required env vars or credentials while both SKILL.md and the code actually require multiple credentials (SKILLPAY_API_KEY, TELEGRAM_BOT_TOKEN, DISCORD_WEBHOOK_URL, EMAIL credentials, optional CLAWHUB/GITHUB tokens). That mismatch between declared registry metadata and the skill's own docs/code is inconsistent and should be questioned.

Instruction Scope

SKILL.md describes running an Express API, endpoints (/discover, /notify, /subscribe, etc.), and environment variables needed for operation — that matches the code. The runtime instructions do not request unrelated system files or weird data collection beyond userId/transactionId/subscription info. The main scope creep risk is the payment flow (SkillPay) which will accept callbacks and mark subscriptions active; that behavior is described in code and docs.

Install Mechanism

There is no external download/install script; typical Node.js package.json and dependencies are used. Dependencies are standard for scraping, HTTP serving, notifications, and scheduling. No high-risk external URLs or archive downloads are present in the manifest.

Credentials

The code and SKILL.md require multiple credentials appropriate for the described features (telegram/discord/email tokens, optional platform tokens, and a SkillPay API key for payments), but the registry metadata declared none — an inconsistency. Critically, the repository/skill.json and README embed a concrete SkillPay API key value (apiKey: sk_e390b52c...), which appears to be a secret included in published files. Hard-coded API credentials in the bundle are a major concern: anyone with that key could call SkillPay endpoints as the skill, manipulate payment verification, or view/modify payment resources tied to that key. This is disproportionate and dangerous if left as-is.

Persistence & Privilege

The skill does not request always:true or modify other skills; it runs an HTTP server and schedules tasks in-process. Autonomous invocation is allowed (default) — combined with the embedded payment key and network access this increases blast radius, but autonomous invocation itself is not unusual.

What to consider before installing

Do not install or run this skill without addressing the embedded credentials and metadata inconsistencies. Specific steps to consider before proceeding: - Treat the SkillPay API key found in skill.json/README as compromised; do not reuse it. Ask the publisher to remove any hard-coded keys and publish a version that requires you to set your own SKILLPAY_API_KEY in environment variables. - Confirm with the maintainer why registry metadata lists no required env vars while SKILL.md and code expect many tokens; prefer a manifest that accurately declares all required secrets. - If you must run this code for testing, do so in a sandboxed environment (isolated VM/container) with fake/test keys and no access to sensitive accounts. - Review/rotate any real credentials you might have exposed while evaluating this skill (especially SkillPay or SMTP credentials). - Audit the SkillPay account (if you control it) for unexpected activity, and ensure payment callbacks are validated (the code uses in-memory subscription storage and marks subscriptions active on POST /payment/callback — consider adding signature verification). - If you don't trust the author or cannot get the hard-coded key removed, avoid installing this skill because the embedded key increases risk of payment/account misuse.

Discover and monitor popular skills across multiple platforms with automated daily notifications.

Features

• 🔍 Multi-platform Monitoring: Clawhub, GitHub Actions, npm packages, and more
• 📊 Skill Analytics: Popularity metrics, usage statistics, trending scores
• 📝 Feature Summaries: Concise descriptions of what each skill does
• 📈 Usage Flowcharts: Visual diagrams showing how to use each skill
• 📱 Multi-channel Notifications: Telegram, Discord, Email
• ⏰ Scheduled Updates: Daily automated skill discovery reports
• 💰 Pay-per-use: 0.001 USDT per API call

API Endpoints

GET /discover

Fetch popular skills from all monitored platforms.

Query Parameters:

• category (optional): Filter by category (ai, productivity, developer-tools, etc.)
• limit (optional): Number of skills to return (default: 10)

Example:

curl "http://localhost:3000/discover?category=ai&limit=5"

Response:

{
  "success": true,
  "data": [
    {
      "name": "awesome-skill",
      "platform": "clawhub",
      "category": "ai",
      "description": "An awesome AI-powered skill",
      "author": "developer",
      "stars": 1234,
      "downloads": 5678,
      "features": ["Feature 1", "Feature 2"],
      "usageFlow": "graph TD; A[Start] --> B[Configure]; B --> C[Run]; C --> D[Results]",
      "url": "https://clawhub.com/skills/awesome-skill"
    }
  ]
}

GET /platform/:platform

Get skills from a specific platform.

Supported Platforms:

• clawhub - Clawhub skills
• github - GitHub Actions
• npm - npm packages with CLI tools

Example:

curl "http://localhost:3000/platform/clawhub?limit=10"

POST /notify

Trigger immediate notification with skill discoveries.

Request:

{
  "userId": "user123",
  "transactionId": "tx456",
  "channels": {
    "telegram": { "chatId": "123456789" }
  },
  "category": "ai",
  "limit": 5
}

POST /subscribe

Subscribe to daily skill discovery updates.

Request:

{
  "userId": "user123",
  "channels": {
    "telegram": { "chatId": "123456789" },
    "email": { "to": "[e-mail]" }
  },
  "preferences": {
    "categories": ["ai", "productivity"],
    "platforms": ["clawhub", "github"],
    "schedule": "0 10 * * *"
  }
}

Configuration

Required environment variables:

• SKILLPAY_API_KEY: SkillPay API key (required)
• TELEGRAM_BOT_TOKEN: Telegram bot token (optional)
• DISCORD_WEBHOOK_URL: Discord webhook URL (optional)
• EMAIL_USER/EMAIL_PASS: SMTP credentials (optional)
• CLAWHUB_TOKEN: Clawhub API token (optional, for higher rate limits)

Installation

npm install
npm start

Pricing

• 0.001 USDT per API call
• Automatic settlement via SkillPay.me

License

MIT