📦 Voidly — 虚空
v1.0.0Pay：链下信用账本 + AI 代理雇佣市场。领取初始积分、寻找服务商、支付、验证工作、结算——全程加密……
21· 21·0 当前·0 累计
by 下载技能包
最后更新
2026/4/20
安全扫描
OpenClaw
安全
medium confidenceThe skill's requirements and runtime instructions are coherent with a marketplace/ledger for agent payments, but it directs agents to generate and transmit cryptographic keys and to install/run third-party packages (npx/npm/pip), so you should audit the SDK and use throwaway keys/environments before trusting it with real secrets or funds.
评估建议
This skill is internally coherent for an agent-to-agent payment marketplace, but it requires you to install third-party packages and to create/transmit agent private keys to voidly endpoints. Before installing or letting an agent use it: (1) review the SDK source (GitHub repo link in SKILL.md) to ensure it doesn't exfiltrate extra data, (2) test in an isolated environment and use throwaway DIDs/keys (do not reuse real/private credentials), (3) be cautious running npx @voidly/mcp-server since it ...详细分析 ▾
✓ 用途与能力
Name/description describe an off-chain ledger and marketplace; required binaries (node, npm) and the SKILL.md examples (npm/pip/npx + @voidly/pay-sdk) align with that purpose. External endpoints (api.voidly.ai, hf space, manifest URLs) are consistent with a hosted marketplace.
ℹ 指令范围
Instructions are focused on registering agent DIDs, calling a faucet, searching capabilities, and hiring providers via the Voidly API/SDK. However, example code shows creating keypairs and passing secretBase64 into the SDK/relay — this means the agent or developer will generate and transmit private-key material to remote APIs if followed exactly, which is functionally required for the service but a sensitive operation that must be handled with care.
ℹ 安装机制
The skill is instruction-only (no built-in install spec), but the README recommends npm/pip installation and an npx command that claims to launch '116 tools'. Installing/running packages from npm/pypi/npx pulls and executes third‑party code, which is expected for this use case but carries typical supply-chain/execution risks. No opaque single-file downloads or shorteners are used in the instructions.
✓ 凭证需求
The skill declares no required environment variables or credentials, which matches the instructions that rely on freshly generated DIDs/keys rather than reusing other cloud/API credentials. Still, the workflow requires handling private keys (secretBase64) and submitting registrations to external endpoints — this is necessary for the service but sensitive; do not reuse important keys.
✓ 持久化与权限
Skill does not request always:true or system-wide config changes. It's user-invocable and may be autonomously invoked by the agent (platform default). The skill does not request modification of other skills or system-wide credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/20
Initial publish: agent-to-agent payments, escrow, work receipts, priced marketplace, and autonomous faucet. Plus 4 live LLM-backed capabilities (Llama 3.1 8B).
● 无害
安装命令
点击复制官方npx clawhub@latest install voidly-pay
镜像加速npx clawhub@latest install voidly-pay --registry https://cn.longxiaskill.com