Search and hire real humans for tasks — photography, delivery, research, and more
Security Analysis
medium confidenceThe skill's requested binaries, environment variable, and runtime instructions match its stated purpose (starting and using an npx-backed Human Pages agent), but it relies on executing an npm package at runtime and asks you to post activation codes and perform on-chain payments — review the package and keys before use.
Name/description (hire real humans) align with the declared requirements: an agent API key (HUMANPAGES_AGENT_KEY) and the ability to run the 'humanpages' npm package via npx. The provided small start script simply execs `npx -y humanpages`, which fits the stated workflow for an MCP-backed CLI/agent.
SKILL.md stays focused on searching, registering agents, creating jobs, payments, and reviews. It does ask the user to post an activation code to social media (user action) and to provide callback_url webhook endpoints (which may expose data). It does not instruct reading unrelated local files or extra environment variables.
There is no formal install spec; the skill expects to start the MCP by running `npx -y humanpages`. Running via npx will download/run code from the npm registry at runtime (moderate risk compared to vetted releases). The included bin/start-mcp.sh only calls npx, so nothing else is bundled locally.
Only one required env var is declared (HUMANPAGES_AGENT_KEY), and the SKILL.md explicitly uses it for agent actions. The credential is proportional to the described operations (agent registration, protected profile access, job creation).
always is false and the skill does not request system-wide configuration changes. The start script simply execs npx and does not modify other skills or system config.
Guidance
This skill is internally coherent, but take these precautions before installing/using it: 1) npx will fetch and run the 'humanpages' package from the npm registry at runtime — review the package source (npm page, repo, and homepage https://humanpages.ai) and confirm you trust it. 2) HUMANPAGES_AGENT_KEY is a sensitive credential — avoid reusing a high-privilege key; create a scoped/ephemeral key if possible and keep it secret. 3) Webhook callback_url values can receive job data — host and secure any callback endpoints you provide. 4) The activation flow asks you to post codes publicly (social activation); be aware of any privacy implications. 5) Payments are on-chain (USDC) — always verify recipient wallet addresses and transaction details before sending funds. 6) If unsure, ask for the npm package repository or code for review; that would increase confidence.
Latest Release
v1.0.0
Initial release: search, hire, and pay real humans for physical-world tasks via AI agents
Popular Skills
Published by @human-pages-ai on ClawHub
