corbits

Enables users to discover and interact with Corbits API proxies, fetch OpenAPI specs, and make API calls efficiently.

Install this skill

or

0/100

Security score

The corbits skill was audited on May 13, 2026 and we found 46 security issues across 5 threat categories, including 3 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

high line 282

Piping content to bash shell

SourceSKILL.md

282	command -v bun >/dev/null 2>&1 \|\| curl -fsSL https://bun.sh/install \| bash

medium line 282

Curl to non-GitHub URL

SourceSKILL.md

282	command -v bun >/dev/null 2>&1 \|\| curl -fsSL https://bun.sh/install \| bash

medium line 18

Access to hidden dotfiles in home directory

SourceSKILL.md

18	`~/.config/corbits/context.json` persists the current proxy between invocations. Written when a proxy is selected. Format:

medium line 43

Access to hidden dotfiles in home directory

SourceSKILL.md

43	Before running any flow that executes `~/.bun/bin/bun rides.ts` (call flow, search flow step 5), verify init has been completed and at least one wallet is configured.

low line 47

Access to hidden dotfiles in home directory

SourceSKILL.md

47	test -f ~/.config/corbits/project/rides.ts && echo "rides=ok" \|\| echo "rides=missing"; security find-generic-password -a corbits -s corbits-solana-keypair -w >/dev/null 2>&1 && echo "sol=ok" \|\| echo "

low line 52

Access to hidden dotfiles in home directory

SourceSKILL.md

52	test -f ~/.config/corbits/project/rides.ts && echo "rides=ok" \|\| echo "rides=missing"; ([ -n "$CORBITS_SOLANA_KEYPAIR" ] \|\| test -s ~/.config/corbits/credentials/solana-keypair) && echo "sol=ok" \|\| ec

medium line 77

Access to hidden dotfiles in home directory

SourceSKILL.md

77	Then read `~/.config/corbits/context.json`. If it exists, also show: "Current proxy: <name> (<url>)". If not, show: "No proxy selected. Run `/corbits search` to find one."

medium line 83

Access to hidden dotfiles in home directory

SourceSKILL.md

83	Read `~/.config/corbits/context.json`. If it exists, show the proxy name and URL. If not, tell the user to search for a proxy first (e.g. `/corbits search openai`).

low line 117

Access to hidden dotfiles in home directory

SourceSKILL.md

117	cat ~/.config/corbits/context.json 2>/dev/null \|\| echo "none"

low line 152

Access to hidden dotfiles in home directory

SourceSKILL.md

152	~/.bun/bin/bun ~/.config/corbits/project/rides.ts GET "<proxy_url><base_path><spec_path>"

low line 157

Access to hidden dotfiles in home directory

SourceSKILL.md

157	~/.bun/bin/bun ~/.config/corbits/project/rides.ts <METHOD> "<proxy_url><base_path><spec_path>" '<json_body>'

low line 173

Access to hidden dotfiles in home directory

SourceSKILL.md

173	cat ~/.config/corbits/context.json 2>/dev/null \|\| echo "none"

medium line 192

Access to hidden dotfiles in home directory

SourceSKILL.md

192	Detect the platform and environment: check `uname -s` (`Darwin` = macOS, `Linux` = Linux) and whether `~/.openclaw` exists (OpenClaw). Use the first matching branch:

medium line 195

Access to hidden dotfiles in home directory

SourceSKILL.md

195	2. OpenClaw — `uname -s` is `Linux` and `~/.openclaw` exists

low line 228

Access to hidden dotfiles in home directory

SourceSKILL.md

228	mkdir -p ~/.config/corbits/credentials && chmod 700 ~/.config/corbits/credentials

low line 233

Access to hidden dotfiles in home directory

SourceSKILL.md

233	printf '%s' '<solana_keypair_value>' > ~/.config/corbits/credentials/solana-keypair && chmod 600 ~/.config/corbits/credentials/solana-keypair

low line 236

Access to hidden dotfiles in home directory

SourceSKILL.md

236	printf '%s' '<evm_key_value>' > ~/.config/corbits/credentials/evm-key && chmod 600 ~/.config/corbits/credentials/evm-key

low line 241

Access to hidden dotfiles in home directory

SourceSKILL.md

241	echo "sol=$(test -f ~/.config/corbits/credentials/solana-keypair && echo configured \|\| echo skipped) evm=$(test -f ~/.config/corbits/credentials/evm-key && echo configured \|\| echo skipped)"

medium line 248

Access to hidden dotfiles in home directory

SourceSKILL.md

248	If the user wants to do it themselves, show them what to add to `~/.openclaw/openclaw.json` under `skills.entries.corbits.env`:

medium line 265

Access to hidden dotfiles in home directory

SourceSKILL.md

265	If the agent should do it, collect the keys from the user, then read `~/.openclaw/openclaw.json`, merge in `skills.entries.corbits.env` with `CORBITS_SOLANA_KEYPAIR` and `CORBITS_EVM_KEY`, and write i

medium line 273

Access to hidden dotfiles in home directory

SourceSKILL.md

273	On macOS, keys are stored in Keychain. On Linux with Claude Code/OpenCode, keys are stored in `~/.config/corbits/credentials/` with restricted permissions. On OpenClaw, keys are injected as env vars f

medium line 285

Access to hidden dotfiles in home directory

SourceSKILL.md

285	After install, source the shell profile or use the full path (`~/.bun/bin/bun`).

low line 290

Access to hidden dotfiles in home directory

SourceSKILL.md

290	mkdir -p ~/.config/corbits/project && ~/.bun/bin/bun init -y --cwd ~/.config/corbits/project && ~/.bun/bin/bun add @faremeter/rides --cwd ~/.config/corbits/project

medium line 293

Access to hidden dotfiles in home directory

SourceSKILL.md

293	### Step 5. Write `~/.config/corbits/project/rides.ts`

medium line 295

Access to hidden dotfiles in home directory

SourceSKILL.md

295	Use the Read tool to read `rides.ts` from this skill's directory (the same directory as this SKILL.md file) and write its contents to `~/.config/corbits/project/rides.ts`. If the skill directory is no

low line 331

Access to hidden dotfiles in home directory

SourceSKILL.md

331	mkdir -p ~/.config/corbits

low line 332

Access to hidden dotfiles in home directory

SourceSKILL.md

332	jq -n --argjson id <id> --arg name "<name>" --arg url "<url>" '{id: $id, name: $name, org_slug: null, url: $url}' > ~/.config/corbits/context.json

low line 337

Access to hidden dotfiles in home directory

SourceSKILL.md

337	mkdir -p ~/.config/corbits

low line 338

Access to hidden dotfiles in home directory

SourceSKILL.md

338	jq -n --argjson id <id> --arg name "<name>" --arg org_slug "<org_slug>" --arg url "<url>" '{id: $id, name: $name, org_slug: $org_slug, url: $url}' > ~/.config/corbits/context.json

low line 361

Access to hidden dotfiles in home directory

SourceSKILL.md

361	~/.bun/bin/bun ~/.config/corbits/project/rides.ts GET "<proxy_url><base_path><spec_path>"

low line 366

Access to hidden dotfiles in home directory

SourceSKILL.md

366	~/.bun/bin/bun ~/.config/corbits/project/rides.ts <METHOD> "<proxy_url><base_path><spec_path>" '<json_body>'

medium line 248

Access to .env file

SourceSKILL.md

248	If the user wants to do it themselves, show them what to add to `~/.openclaw/openclaw.json` under `skills.entries.corbits.env`:

medium line 265

Access to .env file

SourceSKILL.md

265	If the agent should do it, collect the keys from the user, then read `~/.openclaw/openclaw.json`, merge in `skills.entries.corbits.env` with `CORBITS_SOLANA_KEYPAIR` and `CORBITS_EVM_KEY`, and write i

high line 212

Access to system keychain/keyring

SourceSKILL.md

212	Store non-empty keys in Keychain:

high line 273

Access to system keychain/keyring

SourceSKILL.md

273	On macOS, keys are stored in Keychain. On Linux with Claude Code/OpenCode, keys are stored in `~/.config/corbits/credentials/` with restricted permissions. On OpenClaw, keys are injected as env vars f

low line 14

External URL reference

SourceSKILL.md

14	`https://api.corbits.dev`

low line 21

External URL reference

SourceSKILL.md

21	{"id":61,"name":"openai","org_slug":null,"url":"https://openai.api.corbits.dev"}

low line 89

External URL reference

SourceSKILL.md

89	When fetching an OpenAPI spec, extract the base path from the `servers` field. For example, if `servers[0].url` is `https://api.openai.com/v1`, the base path is `/v1`. All spec paths are relative to t

low line 99

External URL reference

SourceSKILL.md

99	WebFetch https://api.corbits.dev/api/v1/proxies/<id>/openapi

low line 104

External URL reference

SourceSKILL.md

104	WebFetch https://api.corbits.dev/api/v1/proxies/<id>/endpoints

low line 122

External URL reference

SourceSKILL.md

122	Print the current proxy name and URL (e.g. "Calling on open-ai (`https://...`)"). Do NOT ask for confirmation -- just continue to step 2.

low line 282

External URL reference

SourceSKILL.md

282	command -v bun >/dev/null 2>&1 \|\| curl -fsSL https://bun.sh/install \| bash

low line 312

External URL reference

SourceSKILL.md

312	WebFetch https://api.corbits.dev/api/v1/search?q=<query>

low line 318

External URL reference

SourceSKILL.md

318	WebFetch https://api.corbits.dev/api/v1/proxies

low line 352

External URL reference

SourceSKILL.md

352	WebFetch https://api.corbits.dev/api/v1/proxies/<proxy-id>/endpoints

low line 399

External URL reference

SourceSKILL.md

399	- The `url` field is computed: `https://{name}.api.corbits.dev` or `https://{name}.{org_slug}.api.corbits.dev` when org_slug is present

Scanned on May 13, 2026

View Security Dashboard

Installation guide →

GitHub Stars 1

Rate this skill

Categorydevelopment

UpdatedMay 13, 2026

claude claude-code cursor opencode frontend stripe docx api testing backend data-engineer ml-ai-engineer backend-developer development

corbits-infra/corbits-skill