corbits

Enables users to discover and interact with Corbits API proxies, fetch OpenAPI specs, and make API calls efficiently.

Install this skill

or

0/100

Security score

The corbits skill was audited on Feb 21, 2026 and we found 48 security issues across 5 threat categories, including 3 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

high line 301

Direct command execution function call

SourceSKILL.md

301	return execSync(

medium line 302

Template literal with variable interpolation in command context

SourceSKILL.md

302	`security find-generic-password -a corbits -s corbits-${service} -w`,

high line 268

Piping content to bash shell

SourceSKILL.md

268	command -v bun >/dev/null 2>&1 \|\| curl -fsSL https://bun.sh/install \| bash

low line 283

Node child_process module reference

SourceSKILL.md

283	import { execSync } from "child_process";

medium line 268

Curl to non-GitHub URL

SourceSKILL.md

268	command -v bun >/dev/null 2>&1 \|\| curl -fsSL https://bun.sh/install \| bash

medium line 18

Access to hidden dotfiles in home directory

SourceSKILL.md

18	`~/.config/corbits/context.json` persists the current proxy between invocations. Written when a proxy is selected. Format:

medium line 43

Access to hidden dotfiles in home directory

SourceSKILL.md

43	Before running any flow that executes `~/.bun/bin/bun rides.ts` (call flow, search flow step 5), verify init has been completed and at least one wallet is configured.

low line 47

Access to hidden dotfiles in home directory

SourceSKILL.md

47	test -f ~/.config/corbits/project/rides.ts && echo "rides=ok" \|\| echo "rides=missing"; security find-generic-password -a corbits -s corbits-solana-keypair -w >/dev/null 2>&1 && echo "sol=ok" \|\| echo "

low line 52

Access to hidden dotfiles in home directory

SourceSKILL.md

52	test -f ~/.config/corbits/project/rides.ts && echo "rides=ok" \|\| echo "rides=missing"; ([ -n "$CORBITS_SOLANA_KEYPAIR" ] \|\| test -s ~/.config/corbits/credentials/solana-keypair) && echo "sol=ok" \|\| ec

medium line 77

Access to hidden dotfiles in home directory

SourceSKILL.md

77	Then read `~/.config/corbits/context.json`. If it exists, also show: "Current proxy: <name> (<url>)". If not, show: "No proxy selected. Run `/corbits search` to find one."

medium line 83

Access to hidden dotfiles in home directory

SourceSKILL.md

83	Read `~/.config/corbits/context.json`. If it exists, show the proxy name and URL. If not, tell the user to search for a proxy first (e.g. `/corbits search openai`).

low line 100

Access to hidden dotfiles in home directory

SourceSKILL.md

100	cat ~/.config/corbits/context.json 2>/dev/null \|\| echo "none"

low line 147

Access to hidden dotfiles in home directory

SourceSKILL.md

147	~/.bun/bin/bun ~/.config/corbits/project/rides.ts GET "<proxy_url><base_path><spec_path>"

low line 152

Access to hidden dotfiles in home directory

SourceSKILL.md

152	~/.bun/bin/bun ~/.config/corbits/project/rides.ts <METHOD> "<proxy_url><base_path><spec_path>" '<json_body>'

low line 164

Access to hidden dotfiles in home directory

SourceSKILL.md

164	cat ~/.config/corbits/context.json 2>/dev/null \|\| echo "none"

medium line 195

Access to hidden dotfiles in home directory

SourceSKILL.md

195	Detect the platform and environment: check `uname -s` (`Darwin` = macOS, `Linux` = Linux) and whether `~/.openclaw` exists (OpenClaw). Use the first matching branch:

medium line 198

Access to hidden dotfiles in home directory

SourceSKILL.md

198	2. OpenClaw — `uname -s` is `Linux` and `~/.openclaw` exists

low line 214

Access to hidden dotfiles in home directory

SourceSKILL.md

214	mkdir -p ~/.config/corbits/credentials && chmod 700 ~/.config/corbits/credentials

low line 219

Access to hidden dotfiles in home directory

SourceSKILL.md

219	printf '%s' '<solana_keypair_value>' > ~/.config/corbits/credentials/solana-keypair && chmod 600 ~/.config/corbits/credentials/solana-keypair

low line 222

Access to hidden dotfiles in home directory

SourceSKILL.md

222	printf '%s' '<evm_key_value>' > ~/.config/corbits/credentials/evm-key && chmod 600 ~/.config/corbits/credentials/evm-key

low line 227

Access to hidden dotfiles in home directory

SourceSKILL.md

227	echo "sol=$(test -f ~/.config/corbits/credentials/solana-keypair && echo configured \|\| echo skipped) evm=$(test -f ~/.config/corbits/credentials/evm-key && echo configured \|\| echo skipped)"

medium line 234

Access to hidden dotfiles in home directory

SourceSKILL.md

234	If the user wants to do it themselves, show them what to add to `~/.openclaw/openclaw.json` under `skills.entries.corbits.env`:

medium line 251

Access to hidden dotfiles in home directory

SourceSKILL.md

251	If the agent should do it, collect the keys from the user, then read `~/.openclaw/openclaw.json`, merge in `skills.entries.corbits.env` with `CORBITS_SOLANA_KEYPAIR` and `CORBITS_EVM_KEY`, and write i

medium line 259

Access to hidden dotfiles in home directory

SourceSKILL.md

259	On macOS, keys are stored in Keychain. On Linux with Claude Code/OpenCode, keys are stored in `~/.config/corbits/credentials/` with restricted permissions. On OpenClaw, keys are injected as env vars f

medium line 271

Access to hidden dotfiles in home directory

SourceSKILL.md

271	After install, source the shell profile or use the full path (`~/.bun/bin/bun`).

low line 276

Access to hidden dotfiles in home directory

SourceSKILL.md

276	mkdir -p ~/.config/corbits/project && ~/.bun/bin/bun init -y --cwd ~/.config/corbits/project && ~/.bun/bin/bun add @faremeter/rides --cwd ~/.config/corbits/project

medium line 279

Access to hidden dotfiles in home directory

SourceSKILL.md

279	### Step 5. Write `~/.config/corbits/project/rides.ts`

low line 396

Access to hidden dotfiles in home directory

SourceSKILL.md

396	echo '{"id":<id>,"name":"<name>","org_slug":<org_slug_or_null>,"url":"<url>"}' > ~/.config/corbits/context.json

low line 423

Access to hidden dotfiles in home directory

SourceSKILL.md

423	~/.bun/bin/bun ~/.config/corbits/project/rides.ts GET "<proxy_url><base_path><spec_path>"

low line 428

Access to hidden dotfiles in home directory

SourceSKILL.md

428	~/.bun/bin/bun ~/.config/corbits/project/rides.ts <METHOD> "<proxy_url><base_path><spec_path>" '<json_body>'

medium line 234

Access to .env file

SourceSKILL.md

234	If the user wants to do it themselves, show them what to add to `~/.openclaw/openclaw.json` under `skills.entries.corbits.env`:

medium line 251

Access to .env file

SourceSKILL.md

251	If the agent should do it, collect the keys from the user, then read `~/.openclaw/openclaw.json`, merge in `skills.entries.corbits.env` with `CORBITS_SOLANA_KEYPAIR` and `CORBITS_EVM_KEY`, and write i

low line 296

Access to .env file

SourceSKILL.md

296	const envVal = process.env[envName];

high line 259

Access to system keychain/keyring

SourceSKILL.md

259	On macOS, keys are stored in Keychain. On Linux with Claude Code/OpenCode, keys are stored in `~/.config/corbits/credentials/` with restricted permissions. On OpenClaw, keys are injected as env vars f

low line 14

External URL reference

SourceSKILL.md

14	`https://api.corbits.dev`

low line 21

External URL reference

SourceSKILL.md

21	{"id":61,"name":"openai","org_slug":null,"url":"https://openai.api.corbits.dev"}

low line 89

External URL reference

SourceSKILL.md

89	When fetching an OpenAPI spec, extract the base path from the `servers` field. For example, if `servers[0].url` is `https://api.openai.com/v1`, the base path is `/v1`. All spec paths are relative to t

low line 105

External URL reference

SourceSKILL.md

105	Print the current proxy name and URL (e.g. "Calling on open-ai (`https://...`)"). Do NOT ask for confirmation -- just continue to step 2.

low line 110

External URL reference

SourceSKILL.md

110	WebFetch https://api.corbits.dev/api/v1/proxies/<id>/openapi

low line 118

External URL reference

SourceSKILL.md

118	WebFetch https://api.corbits.dev/api/v1/proxies/<id>/endpoints

low line 172

External URL reference

SourceSKILL.md

172	WebFetch https://api.corbits.dev/api/v1/proxies/<id>/openapi

low line 180

External URL reference

SourceSKILL.md

180	WebFetch https://api.corbits.dev/api/v1/proxies/<id>/endpoints

low line 268

External URL reference

SourceSKILL.md

268	command -v bun >/dev/null 2>&1 \|\| curl -fsSL https://bun.sh/install \| bash

low line 378

External URL reference

SourceSKILL.md

378	WebFetch https://api.corbits.dev/api/v1/search?q=<query>

low line 384

External URL reference

SourceSKILL.md

384	WebFetch https://api.corbits.dev/api/v1/proxies

low line 402

External URL reference

SourceSKILL.md

402	WebFetch https://api.corbits.dev/api/v1/proxies/<proxy-id>/openapi

low line 414

External URL reference

SourceSKILL.md

414	WebFetch https://api.corbits.dev/api/v1/proxies/<proxy-id>/endpoints

low line 459

External URL reference

SourceSKILL.md

459	- The `url` field is computed: `https://{name}.api.corbits.dev` or `https://{name}.{org_slug}.api.corbits.dev` when org_slug is present

Scanned on Feb 21, 2026

View Security Dashboard

Install this skill with one command

/learn @corbits-infra/corbits

GitHub Stars 1

Rate this skill

Categorydevelopment

UpdatedMarch 29, 2026

openclaw api backend data-engineer ml-ai-engineer backend-developer development

corbits-infra/corbits-skill