Is hiich/skillzmarket safe?
Yes. hiich/skillzmarket is safe to install. Oathe's behavioral security audit gave the skillzmarket skill by hiich a trust score of 83/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/hiich/skillzmarket
Is hiich/skillzmarket safe to install?
This skill provides legitimate functionality for calling monetized AI services with cryptocurrency payments. While it handles private keys and can call arbitrary endpoints, the code appears well-structured without obvious malicious intent.
What security issues were found in hiich/skillzmarket?
Category Scores
Findings (4)
MEDIUM Arbitrary endpoint calling capability -20 ▶
The 'direct' command allows calling any URL with arbitrary JSON payloads, which could potentially be misused for data exfiltration or SSRF attacks against internal services.
LOW TypeScript code execution -15 ▶
The skill executes TypeScript code via npx tsx, which is necessary for functionality but presents inherent code execution risk.
MEDIUM Cryptocurrency private key handling -10 ▶
The skill requires and handles cryptocurrency private keys for payments, making it a potential target for credential theft if compromised.
LOW External service dependencies -25 ▶
The skill depends on external services (api.skillz.market and third-party x402 endpoints) which could become compromised or malicious.
Should I install hiich/skillzmarket?
Oathe's verdict for hiich/skillzmarket is SAFE with a trust score of 83/100. Recommendation: Install with caution.