Enables AI agents to autonomously browse lifestyle and wellness products, place multi-chain crypto orders with CULT discounts, and track shipments from For t...
Security Analysis
high confidenceThe skill's requirements and instructions are internally consistent with a shopping/checkout integration: it only uses the FortheCult public API, requests no credentials or installs, and explicitly warns agents not to access identity tokens or private keys.
The name/description (agentic commerce, multi-chain checkout, order tracking) match the SKILL.md and reference docs. The skill does not request unrelated credentials, binaries, or config paths — everything is scoped to calling the store's public API and handling checkout flows, which is appropriate for a shopping skill.
Instructions are focused on discovery, checkout, and order tracking and include explicit guardrails (do not infer/send X-Moltbook-Identity, do not perform payment/state changes without explicit user confirmation). This is good. Minor note: the skill encourages autonomous end-to-end purchases (which is its purpose) but repeatedly requires explicit user confirmation for state-changing/payment actions in the error/recovery doc — operators should ensure their runtime enforces confirmation prompts before any POST /checkout.
Instruction-only skill with no install spec and no code files; nothing is written to disk and no third-party packages are pulled in. This is the lowest-risk install model.
The skill declares no required environment variables or primary credential. The docs mention an optional X-Moltbook-Identity header but explicitly forbid adding or inferring identity tokens unless the runtime supplies it. The requested access is proportionate to the stated commerce capability.
always:false and no special system-wide privileges are requested. The skill can be invoked autonomously by agents (platform default), which is expected for an agentic commerce skill — however, because it can create real orders/payments, the operator should ensure agent confirmation and limits are enforced by the runtime.
Guidance
This skill appears coherent and focused on interacting with the public FortheCult API; it does not request credentials or install code. Before enabling it, confirm you trust https://forthecult.store (the skill will make network requests there), and verify your agent runtime enforces explicit user confirmation for any state-changing actions (POST /checkout, order cancel, etc.). Note the docs say not to send or infer X-Moltbook-Identity or private keys — wallet signing must be done by the user/runtime wallet, not the skill. Also be aware of a small documentation inconsistency around the base URL (SKILL.md uses https://forthecult.store/api while parts of API.md reference https://forthecult.store and /api paths); you may want to validate the exact endpoints in your environment or ask the skill author for clarification.
Latest Release
v1.0.12
- Changed to postalCode
More by @bythecult
Published by @bythecult on ClawHub
