Skills/ClawHub/opensea-marketplace

opensea-marketplace@2.31.1

CAUTION· static only

Publisher claims: "Query NFT and token data, trade NFTs on Seaport, swap ERC20 tokens via DEX aggregator, configure wallet signing providers, and build/register/gate AI agent tools on Base. Covers the full OpenSea developer surface across CLI, MCP server, shell scripts, and SDK. Pick the right sub-skill using the routing table below, then read that sub-skill's SKILL.md for operational detail." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher opensea · publishing for 40 daysInstalls 4,607Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-10 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
npx invocation of non-well-known packageopensea-tool-sdk/SKILL.md:206 · npx invocation of non-well-known package — may execute untrusted codenpx @opensea/tool-sdk register \Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionopensea-marketplace/SKILL.md:72 · File type combined with upload action — agent may exfiltrate local data files| Collection or trait offer | `opensea offers build --body build.json`, sign, then `opensea offers post-criteria --body signed.json` | no |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Collapsed <details> block carrying instructionsopensea-wallet/references/wallet-setup.md:90 · Collapsed <details> block carrying instructions<summary>Fallback: verify via curl</summary> ```bash curl -s "https://api.privy.io/v1/wallets/$PRIVY_WALLET_ID" \ -H "Authorization: Basic $(printf "%s:%s" "$PRFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageopensea-api/SKILL.md:35 · npx invocation of non-well-known package — may execute untrusted codenpm install -g @opensea/cli # or prefix commands with: npx @opensea/cliFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageopensea-tool-sdk/SKILL.md:201 · npx invocation of non-well-known package — may execute untrusted codenpx @opensea/tool-sdk register \Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionopensea-marketplace/SKILL.md:40 · File type combined with upload action — agent may exfiltrate local data filesopensea listings actions --body list.json --send --yes --expect-plan <digest> # after the user says yesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageopensea-tool-sdk/SKILL.md:212 · npx invocation of non-well-known package — may execute untrusted codenpx @opensea/tool-sdk register --metadata ... --network base --dry-runFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandopensea-api/scripts/auth/opensea-resolve-key.sh:85 · File permission modification command — agent changes file ownership/permissionschmod 600 "$key_file" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionopensea-marketplace/SKILL.md:70 · File type combined with upload action — agent may exfiltrate local data files| List an NFT | `opensea listings actions --body list.json` | yes, posts the listing |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionopensea-marketplace/SKILL.md:71 · File type combined with upload action — agent may exfiltrate local data files| Offer on an NFT | `opensea offers actions --body offer.json` | yes, posts the offer |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageopensea-tool-sdk/SKILL.md:361 · npx invocation of non-well-known package — may execute untrusted codenpx @opensea/tool-sdk init --runtime vercel # then edit src/manifest.ts and src/handler.tsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageopensea-tool-sdk/SKILL.md:108 · npx invocation of non-well-known package — may execute untrusted codenpx @opensea/tool-sdk init --runtime vercel # or: cloudflare, expressFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈13,800 tok
7 files · 93 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim opensea: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim openseaPropose a patch to the maintainer