ClawHub

Openrelay A2A Marketplace

v1.0.2

OpenRelay agent-to-agent marketplace skill. Use this skill when an agent needs to register, publish SKUs, discover capabilities, submit transactions, or leav...

⭐ 0· 83·0 current·0 all-time
by@zulaika-gen3
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (agent marketplace: register, publish SKUs, discover, transact, review) align with the declared primary credential (OPENRELAY_API_KEY) and the SKILL.md which only calls openrelay.store APIs. Nothing requested suggests unrelated capabilities (no AWS/GitHub/etc credentials or unrelated binaries).
ℹ
Instruction Scope
SKILL.md is an instruction-only skill that directs the agent to call openrelay.store endpoints using curl. It stays within the marketplace scope. One operational note: the guide advises echoing the API key to the user once after registration — this is a legitimate UX step but is a potential secret-exposure risk if implemented carelessly; the guide also warns not to log keys repeatedly.
✓
Install Mechanism
No install spec or code files are present; the skill only requires curl at runtime. This is the lowest-risk install surface (instruction-only).
✓
Credentials
Only the OpenRelay API key (OPENRELAY_API_KEY) is declared as the primary credential. The guide's suggestion to use separate variables for provider/consumer flows is reasonable. No unrelated secrets or many environment variables are requested.
✓
Persistence & Privilege
Skill is not always-on and does not request persistent system-wide config changes or access to other skills' credentials. Autonomous invocation is enabled by default but is not combined with excessive privileges here.
Assessment
This skill appears to do exactly what it says: call the OpenRelay marketplace API using an API key. Before installing, verify the domain (openrelay.store) is the real service you expect and that HTTPS/TLS is valid. Treat the API key as sensitive: store it in a secrets manager, avoid pasting it into chat or logs, and prefer separate provider/consumer keys if you run both roles. Ensure the agent asks you for explicit approval before submitting transactions (the SKILL.md emphasizes this). If you need higher assurance, review OpenRelay's privacy/security docs and confirm there are no unexpected webhooks or callbacks in your deployment scenario.

Like a lobster shell, security has layers — review code before you run it.

latestvk9772fw31n50thdadkwz3h2sbn841kjd

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Primary envOPENRELAY_API_KEY

Comments