📦 MintGarden — 浏览NFT
v1.0.0接入 MintGarden API，一键检索 Chia NFT 与合集，实时查看统计、成交记录、热门榜单及用户资料。
1· 1.6k·0 当前·0 累计
by 下载技能包
最后更新
2026/2/26
安全扫描
OpenClaw
安全
high confidenceThe MintGarden skill is an internally consistent MintGarden API client/CLI for browsing Chia NFTs; it makes expected network calls to api.mintgarden.io and does not request extra credentials or suspicious permissions, with only a few small documentation/code inconsistencies to note.
评估建议
This skill appears to do what it says: a MintGarden API client/CLI that talks to https://api.mintgarden.io. Before installing, consider:
- The SKILL.md mentions an optional MINTGARDEN_API_URL env var, but the shipped index.js constructs MintGardenAPI() without reading process.env; if you need to point the skill at a different base URL you would need to modify the code or the constructor call.
- The CLI lowercases incoming commands (index.js lowercases the entire input). That could alter case...详细分析 ▾
✓ 用途与能力
The package, SKILL.md, README, and source files consistently implement a MintGarden API client and CLI for searching collections, NFTs, profiles, events, and stats. The code calls the MintGarden API (https://api.mintgarden.io) and exposes CLI commands matching the documented commands. No unrelated services, cloud credentials, or binaries are requested.
ℹ 指令范围
Runtime instructions (SKILL.md) describe CLI/agent usage and an optional MINTGARDEN_API_URL env var. The code implements the documented API client and command handling. Two small scope mismatches: (1) SKILL.md documents an optional MINTGARDEN_API_URL environment variable, but the code (index.js + lib/api.js) does not read process.env.MINTGARDEN_API_URL when constructing the client (the API class accepts a constructor param but index.js instantiates it with no env var), so the documented env var is ineffective; (2) SKILL.md mentions Telegram integration; the code provides CLI/handleCommand functions but contains no direct Telegram bot code — Telegram support is expected to be provided by the surrounding Clawdbot/agent platform. Neither mismatch indicates malicious behavior but they are usability/integration inconsistencies.
✓ 安装机制
There is no platform install spec (install is not auto-declared), but an install.sh and package.json are included. install.sh runs npm install --production and is straightforward. Dependencies are standard (axios). No downloads from arbitrary URLs, no archives extracted, and no exotic install steps were used.
✓ 凭证需求
The skill declares no required environment variables or credentials, and the code does not request secrets. The only network target is the public MintGarden API. The SKILL.md optional environment variable (MINTGARDEN_API_URL) is not actually consumed by the code, an inconsistency but not a credential risk.
✓ 持久化与权限
The skill does not request persistent elevated privileges or 'always' inclusion. It is a normal runtime skill (user-invocable, agent-invocable). It does not modify other skills or system-wide config. Installation writes typical node modules only if you run npm install.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/1/30
Initial release: Complete MintGarden API client with search, collections, NFTs, profiles, events. CLI and Telegram support.
● 无害
安装命令
点击复制官方npx clawhub@latest install mintgarden
镜像加速npx clawhub@latest install mintgarden --registry https://cn.longxiaskill.com镜像同步中