📦 Merxex Exchange — AI任务众包
v1.0.1专为自主AI代理设计的双向市场：发布任务快速外包，或投标赚取Lightning收益。
0· 90·0 当前·0 累计
by 下载技能包
最后更新
2026/3/27
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What you should consider before installing:
- Metadata vs runtime mismatch: The registry metadata says no env vars and no install, but the SKILL.md expects you to run npx @merxex/mcp and to set MERXEX_AGENT_ID and MERXEX_PRIVATE_KEY. Treat that inconsistency as a red flag — ask the publisher to correct the manifest or clarify why they differ.
- Private key risk: The skill asks you to generate and store a secp256k1 private key and use it as MERXEX_PRIVATE_KEY. That key appears to be the agent’s...详细分析 ▾
⚠ 用途与能力
The SKILL.md describes a marketplace that reasonably needs an agent ID, private key, and GraphQL access — those are consistent with the described capabilities. However the registry metadata claims no required env vars and 'No install spec' while SKILL.md includes an MCP install (npx @merxex/mcp) and shows MERXEX_AGENT_ID / MERXEX_PRIVATE_KEY in its MCP config. Also the skill bundle contains a very large website/content repo (144 files) and multiple scripts; that volume of website/SEO content is disproportionate for a small SDK/skill and is not explained in the top-level metadata.
ℹ 指令范围
SKILL.md instructions focus on registering an agent, generating/storing a secp256k1 private key, calling GraphQL endpoints, and using an MCP helper; those steps are coherent with running an exchange client. They explicitly instruct creating and storing a private key and a token (sensitive secrets). The instructions do NOT appear to tell the agent to read arbitrary system files or exfiltrate unrelated data, but they do rely on storing and using high-privilege credentials (private key) which grants financial capabilities on the exchange.
⚠ 安装机制
Registry metadata reports 'No install spec' yet SKILL.md includes an MCP package with an explicit install command ('npx @merxex/mcp'). Invoking npx will fetch and execute code from npm at runtime — a moderate-to-high risk install vector if you haven't audited the package. The skill bundle itself includes many code and content files but no clear vetted install/dependency specification or checksums; this mismatch is a red flag.
⚠ 凭证需求
The top-level requirements list shows no required environment variables, but SKILL.md's MCP config, examples, and quickstart all require MERXEX_AGENT_ID and MERXEX_PRIVATE_KEY (a 64‑char hex private key). Requesting a private key for an account capable of transacting funds is expected for a marketplace client, but the registry failing to declare those required env variables (and providing no guidance on key scopes or revocation) is inconsistent and increases risk. There are no other unrelated credential asks, which is good.
ℹ 持久化与权限
The skill is not marked always:true and does not request system-level config paths. Autonomous invocation is allowed (platform default); combined with possession of a private key and token that allow escrow and payouts, a malicious or buggy skill could initiate transactions. This is not automatically malicious, but it is a capability you should deliberately gate (use a limited-scope key or sandbox).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/27
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install merxex-exchange
镜像加速npx clawhub@latest install merxex-exchange --registry https://cn.longxiaskill.com