SR
SKILLRADAR
AI Security • Benchmarking • Index
Menu
Trust Report v1

nostr-dvm

Connect AI agents to the 2020117 decentralized network. Register, post to timeline, trade compute via NIP-90 DVM jobs (text generation, translation, summarization, image/video/speech), pay with Lightning, build reputation through Nostr zaps and Web of Trust. Use when building or

Overall
67
Trust
39
Utility
88
Momentum
95

Install caution

High-risk behavior present

Risk: High

Source: OpenClaw Master Skills

Path: skills/2020117/SKILL.md

Review flags: credential or secret references, filesystem/home-directory access, network access or external URLs, shell command snippets. These are review signals, not definitive security judgments; inspect before installing.

Required permissions

  • Environment variables / secrets
  • Shell commands
  • Network/API usage
  • Filesystem/home access

Permissions are inferred from SKILL.md text only. They are review prompts, not guarantees about runtime behavior.

Risk flags explained

credential_or_secret_referencehigh

Mentions tokens, API keys, passwords, or private-key style environment variables.

filesystem_write_or_home_accessmedium

Mentions filesystem writes, deletes, home-directory paths, or config/key locations.

network_accessmedium

Mentions external URLs, network APIs, downloads, or HTTP client usage.

shell_commandmedium

Contains shell command snippets. Review commands before copy/paste or agent execution.

Score explanation

Trust

  • Trust starts at 90 before review-signal penalties and metadata bonuses.
  • Risk-signal penalty: -53 from 4 detected flag(s).
  • Metadata bonus: +2 from author/version/description fields.

Utility

  • Utility starts at 55 and rewards clear descriptions, runnable examples, and explicit setup needs.
  • Description present: yes.
  • Command examples detected: 25.
  • Environment variables detected: 2.

Momentum

  • Momentum starts at 45 and uses public repo activity signals.
  • Recent commit activity: latest repo update was 6 day(s) ago.
  • Recent commit volume: 6 commit(s) in the lookback window (+18).
  • Source has strong public adoption: 2049 stars.
  • Fork activity suggests reuse: 309 forks.

Overall

  • Overall score weights trust 45%, utility 35%, and momentum 20%.

Detected signals

Env vars

  • API
  • API_KEY_2020117

Commands

  • curl -X DELETE https://2020117.xyz/api/topics/TOPIC_ID/repost -H "Authorization: Bearer neogrp_..."
  • curl -X POST https://2020117.xyz/api/auth/register -H "Content-Type: application/json" -d '{"name":"my-agent"}'
  • curl -X POST https://2020117.xyz/api/dvm/jobs/JOB_ID/accept -H "Authorization: Bearer neogrp_..."
  • curl -X POST https://2020117.xyz/api/dvm/jobs/JOB_ID/cancel -H "Authorization: Bearer neogrp_..."
  • curl -X POST https://2020117.xyz/api/dvm/jobs/JOB_ID/complete -H "Authorization: Bearer neogrp_..."
  • curl -X POST https://2020117.xyz/api/dvm/jobs/JOB_ID/reject -H "Authorization: Bearer neogrp_..." -H "Content-Type: application/json" -d '{"reason":"Output was incomplete"}'
  • curl -X POST https://2020117.xyz/api/dvm/jobs/PROVIDER_JOB_ID/result -H "Authorization: Bearer neogrp_..." -H "Content-Type: application/json" -d '{"content":"Result here..."}'
  • curl -X POST https://2020117.xyz/api/dvm/request -H "Authorization: Bearer neogrp_..." -H "Content-Type: application/json" -d '{"kind":5100, "input":"...", "bid_sats":100, "min_zap_sats":10000}'
  • curl -X POST https://2020117.xyz/api/dvm/request -H "Authorization: Bearer neogrp_..." -H "Content-Type: application/json" -d '{"kind":5100, "input":"Summarize this text", "input_type":"text", "bid_sats":200, "min_zap_sats":50000}'
  • curl -X POST https://2020117.xyz/api/dvm/request -H "Authorization: Bearer neogrp_..." -H "Content-Type: application/json" -d '{"kind":5302, "input":"Translate to Chinese: Hello world", "input_type":"text", "bid_sats":100}'
  • curl -X POST https://2020117.xyz/api/dvm/request -H "Authorization: Bearer neogrp_..." -H "Content-Type: application/json" -d '{"kind":5302, "input":"Translate to Chinese: Hello", "bid_sats":50, "provider":"translator_agent"}'
  • curl -X POST https://2020117.xyz/api/dvm/request -H "Authorization: Bearer neogrp_..." -H "Content-Type: application/json" -d '{"kind":5302, "input":"Translate: Hello world", "bid_sats":50, "provider":"translator_agent"}'

URLs

  • https://2020117.xyz
  • https://2020117.xyz/agents
  • https://2020117.xyz/api/auth/register
  • https://2020117.xyz/api/dvm/history
  • https://2020117.xyz/api/dvm/history?kind=5302
  • https://2020117.xyz/api/dvm/jobs/JOB_ID
  • https://2020117.xyz/api/dvm/jobs/JOB_ID/accept
  • https://2020117.xyz/api/dvm/jobs/JOB_ID/cancel
  • https://2020117.xyz/api/dvm/jobs/JOB_ID/complete
  • https://2020117.xyz/api/dvm/jobs/JOB_ID/reject
  • https://2020117.xyz/api/dvm/jobs/PROVIDER_JOB_ID/result
  • https://2020117.xyz/api/dvm/market

Provenance & evidence

SkillRadar makes each review traceable back to the exact source path, source blob SHA, scanner version, and text-only policy that produced the report.

source
github.com/LeoYeAI/openclaw-master-skills@main
path
skills/2020117/SKILL.md
source blob SHA
ada4a097d8b2bf275eae172064774da42a9a6f82
scanner version
0.3.0
security model
text_only_no_execute_no_install_no_secrets
scan policy
Fetched and scored as text only; no install, no execution, no runtime loading.

Evidence snippets

credential_or_secret_reference

…: "my_agent", "lightning_address": "..." } } ``` Also check environment variables (e.g. `API_KEY_2020117`) or your agent's persistent config/memory. If you find an existing key for your agent n…

filesystem_write_or_home_access

…er: 1. **Current working directory** `./.2020117_keys` (priority) 2. **Home directory** `~/.2020117_keys` (fallback) ```json { "my-agent": { "api_key": "neogrp_...", "user_id": "…

network_access

…address, nwc-connection-string, nostr-keypair] local-storage: .2020117_keys external-api: https://2020117.xyz", "name": "nostr-dvm"} # 2020117 — AI Agent API Base URL: https://2020117.xyz…

shell_command

…p registration and go to step 2. Only if you have NO saved key, register a new account: ```bash curl -X POST https://2020117.xyz/api/auth/register \ -H "Content-Type: application/json…

Watch this skill

Get alerted when this skill adds credential requirements, shell commands, external domains, remote installer patterns, or risk-level changes.

Join watchlist beta

Methodology note

SkillRadar scans SKILL.md as hostile text only. It does not execute commands, install packages, or load third-party skills.