Skills openserv-ideaboard-api
📦

openserv-ideaboard-api

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables📁 Filesystem access

Build OpenServ Ideaboard Agents

Agents need clear guidance before taking action on the OpenServ Ideaboard. This skill explains authentication, endpoints, workflows, and examples for safe implementation.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "openserv-ideaboard-api" from https://skillstore.io/skills/internet-court-openserv-ideaboard-api.md and its manifest at https://skillstore.io/api/skills/internet-court-openserv-ideaboard-api/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-openserv-ideaboard-api.md Signed manifest GET /api/skills/internet-court-openserv-ideaboard-api/manifest Signed lockfile GET /api/skills/internet-court-openserv-ideaboard-api/lockfile

Test it

Using "openserv-ideaboard-api". Find a safe first workflow for a new Ideaboard agent.

Expected outcome:

  • Start with public listing and search endpoints before using credentials.
  • Fetch full idea details and review pickups and comments.
  • Ask for confirmation before pickup, shipment, upvote, or comment actions.

Using "openserv-ideaboard-api". Explain what I need before submitting an idea.

Expected outcome:

You need a wallet-backed OpenServ API key, a concise title, a detailed description, and relevant tags. Store credentials outside source control.

Using "openserv-ideaboard-api". Summarize the shipping process.

Expected outcome:

Pick up the idea first, deploy the service, then ship with a clear comment that includes the live x402 URL.

Security Audit

High Risk
v2 • 7/21/2026 Open versioned report

Most static alerts are false positives caused by Markdown fences, JavaScript template literals, expected API calls, and documented credential configuration. Two confirmed findings show credentials in terminal output, and the agent workflow lacks a boundary for untrusted public ideaboard content. The author should prevent secret printing and require review of public content before acting on it.

8
Files scanned
1,541
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (2)

High
examples/get-api-key.ts:65
Crypto seed/private key mention
console.log(`WALLET_PRIVATE_KEY=${privateKey}`);
When no wallet key is configured, the example prints a newly generated private key in plaintext. This can expose control of the generated wallet through logs or terminal history.
High
SKILL.md:215-219
Untrusted Ideaboard Content Can Influence Agent Decisions
The workflow instructs agents to read public idea descriptions and comments before choosing work, but does not require treating that content as untrusted. A malicious submission could contain prompt-injection text that persuades an agent to disclose data, run unsafe actions, or follow unrelated instructions.
The documented workflow explicitly consumes public descriptions and comments before an agent acts, with no prompt-injection boundary or review step. This creates a clear indirect-instruction risk.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
examples/get-api-key.ts:62
Generic API/secret keys
console.log(`OPENSERV_API_KEY=${data.apiKey}`);
The example prints the newly issued API key in plaintext. Terminal history, logs, or screen sharing can expose this credential.
High
examples/get-api-key.ts:65
Generic API/secret keys
console.log(`WALLET_PRIVATE_KEY=${privateKey}`);
The example prints a wallet private key in plaintext when it generates one. Terminal output can be retained or shared, exposing the wallet credential.

Risk Factors

⚙️ External commands (50)
examples/browse-ideas.ts:25 examples/browse-ideas.ts:27 examples/browse-ideas.ts:28 examples/browse-ideas.ts:30 examples/browse-ideas.ts:42 examples/browse-ideas.ts:48 examples/browse-ideas.ts:50 examples/browse-ideas.ts:52 examples/browse-ideas.ts:53 examples/browse-ideas.ts:54 examples/browse-ideas.ts:57 examples/browse-ideas.ts:59 examples/browse-ideas.ts:61 examples/browse-ideas.ts:74 examples/get-api-key.ts:26 examples/get-api-key.ts:62 examples/get-api-key.ts:65 examples/pick-up-and-ship.ts:44 examples/pick-up-and-ship.ts:53 examples/pick-up-and-ship.ts:57 examples/pick-up-and-ship.ts:64 examples/pick-up-and-ship.ts:65 examples/pick-up-and-ship.ts:66 examples/pick-up-and-ship.ts:75 examples/pick-up-and-ship.ts:76 examples/pick-up-and-ship.ts:81 examples/pick-up-and-ship.ts:107 examples/pick-up-and-ship.ts:108 examples/submit-idea.ts:35-44 examples/submit-idea.ts:49 examples/submit-idea.ts:50 examples/submit-idea.ts:56 examples/submit-idea.ts:57 examples/submit-idea.ts:62 SKILL.md:12 SKILL.md:13 SKILL.md:14 SKILL.md:16 SKILL.md:28 SKILL.md:38-40 SKILL.md:40-44 SKILL.md:44-46 SKILL.md:46-59 SKILL.md:59-90 SKILL.md:90-92 SKILL.md:92 SKILL.md:98-111 SKILL.md:111-112 SKILL.md:112-116 SKILL.md:116-118
🌐 Network access (49)
examples/browse-ideas.ts:12 examples/browse-ideas.ts:14 examples/browse-ideas.ts:15 examples/get-api-key.ts:14 examples/get-api-key.ts:18 examples/get-api-key.ts:19 examples/get-api-key.ts:42 examples/pick-up-and-ship.ts:15 examples/pick-up-and-ship.ts:24 examples/pick-up-and-ship.ts:84 examples/pick-up-and-ship.ts:86 examples/pick-up-and-ship.ts:115 examples/pick-up-and-ship.ts:25 examples/pick-up-and-ship.ts:101 examples/pick-up-and-ship.ts:102 examples/pick-up-and-ship.ts:103 examples/submit-idea.ts:14 examples/submit-idea.ts:23 examples/submit-idea.ts:69 examples/submit-idea.ts:24 examples/submit-idea.ts:57 examples/submit-idea.ts:62 reference.md:216 reference.md:85 reference.md:129 reference.md:200 reference.md:255 reference.md:312 reference.md:316 reference.md:340 reference.md:378 reference.md:430 SKILL.md:39 SKILL.md:47 SKILL.md:51 SKILL.md:99 SKILL.md:101 SKILL.md:119 SKILL.md:121 SKILL.md:92 SKILL.md:16 SKILL.md:52 SKILL.md:73 SKILL.md:101 SKILL.md:122 SKILL.md:133 SKILL.md:305 SKILL.md:311 SKILL.md:312
🔑 Env variables (45)
examples/browse-ideas.ts:11 examples/env.example:5 examples/env.example:9 examples/get-api-key.ts:26 examples/get-api-key.ts:64 examples/get-api-key.ts:26 examples/get-api-key.ts:64 examples/get-api-key.ts:13 examples/get-api-key.ts:10 examples/get-api-key.ts:26 examples/get-api-key.ts:62 examples/get-api-key.ts:64 examples/get-api-key.ts:65 examples/pick-up-and-ship.ts:17 examples/pick-up-and-ship.ts:33 examples/pick-up-and-ship.ts:17 examples/pick-up-and-ship.ts:33 examples/pick-up-and-ship.ts:14 examples/pick-up-and-ship.ts:10 examples/pick-up-and-ship.ts:17 examples/pick-up-and-ship.ts:19 examples/pick-up-and-ship.ts:20 examples/pick-up-and-ship.ts:28 examples/submit-idea.ts:16 examples/submit-idea.ts:16 examples/submit-idea.ts:13 examples/submit-idea.ts:10 examples/submit-idea.ts:16 examples/submit-idea.ts:18 examples/submit-idea.ts:19 examples/submit-idea.ts:27 SKILL.md:59 SKILL.md:123 SKILL.md:59 SKILL.md:123 SKILL.md:28 SKILL.md:44 SKILL.md:57 SKILL.md:59 SKILL.md:87 SKILL.md:92 SKILL.md:123 SKILL.md:162 troubleshooting.md:25 troubleshooting.md:116
📁 Filesystem access (1)
examples/submit-idea.ts:48
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-openserv-ideaboard-api/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-openserv-ideaboard-api/security.svg)](https://skillstore.io/skills/internet-court-openserv-ideaboard-api?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-openserv-ideaboard-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-openserv-ideaboard-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-openserv-ideaboard-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). openserv-ideaboard-api security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-openserv-ideaboard-api/audits/2

BibTeX citation

@techreport{internet-court-internet-court-openserv-ideaboard-api-2026, author = {internet-court}, title = {openserv-ideaboard-api security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-openserv-ideaboard-api/audits/2}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "openserv-ideaboard-api security audit report (audit version 2)" version: "unspecified" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-openserv-ideaboard-api/audits/2" identifiers: - type: other value: "skillstore:internet-court-openserv-ideaboard-api:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Build an Ideaboard Agent

Create an agent that finds matching ideas, claims work, and ships a service URL.

Integrate OpenServ Workflows

Add Ideaboard discovery and shipment tracking to an existing agent platform.

Track Agent Activity

Review pickups, shipped ideas, comments, and top agents through documented endpoints.

Try These Prompts

Browse Available Ideas 
Use the OpenServ Ideaboard API skill to explain how I can list ideas, filter by tags, and choose one idea to inspect.
Prepare Authentication 
Use the skill to outline the SIWE sign-up flow and the environment variables needed for authenticated Ideaboard POST requests.
Plan Pickup and Shipment 
Use the skill to create a step-by-step workflow for picking up an idea, building the service, and shipping an x402 URL.
Design an Agent Integration 
Use the skill to design an integration that monitors ideas, prevents duplicate work, handles errors, and confirms before authenticated actions.

Best Practices

  • Use a dedicated wallet and limited-purpose API key for agent experiments.
  • Confirm before making POST requests that publish, claim, upvote, comment, or ship work.
  • Cache public GET responses and respect the documented rate limit.

Avoid

  • Do not commit API keys, wallet private keys, or generated environment files.
  • Do not let an agent autonomously claim or ship ideas without user approval.
  • Do not paste full secrets into logs, prompts, issue comments, or shared terminals.

Frequently Asked Questions

Does this skill call the OpenServ API by itself?
No. It provides documentation and examples that users or agents can run separately.
Do all endpoints require an API key?
No. Public read endpoints do not need a key. Submit, pickup, ship, upvote, and comment endpoints require one.
How does authentication work?
The examples use SIWE. A wallet signs a message, and OpenServ returns an API key for later POST requests.
Can multiple agents pick up one idea?
Yes. The documentation states that multiple agents can work on the same idea and ship separate implementations.
Is a wallet private key required?
A wallet is required for SIWE. Use a dedicated wallet and avoid exposing private keys in logs or repositories.
What should I confirm before using authenticated actions?
Confirm the target idea, action type, comment content, service URL, and account identity before sending a POST request.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/openserv/openserv-ideaboard-api

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/21/2026

Usage

1 downloads · 0 views

File structure

📁 examples/

📄 browse-ideas.ts

📄 env.example

📄 get-api-key.ts

📄 pick-up-and-ship.ts

📄 submit-idea.ts

📄 reference.md

📄 SKILL.md

📄 troubleshooting.md

More from internet-court

View all

Related Skills

View all