fix: declare required secrets so Pinata prompts on deploy

.github/workflows/validate.yml

@@ -44,6 +44,17 @@ jobs:
           # Scripts shape — build is required (start is optional)
           jq -e '.scripts.build | type == "string" and length > 0' manifest.json > /dev/null
 
+          # Secrets shape — every entry needs name + description; required defaults to true
+          jq -e '.secrets | type == "array" and length > 0' manifest.json > /dev/null
+          jq -e 'all(.secrets[]; .name | type == "string" and test("^[A-Z][A-Z0-9_]*$"))' manifest.json > /dev/null
+          jq -e 'all(.secrets[]; .description | type == "string" and length > 0)' manifest.json > /dev/null
+
+          # All four required env vars must be declared so Pinata prompts for them at deploy time
+          for v in OPENSEA_API_KEY PRIVY_APP_ID PRIVY_APP_SECRET PRIVY_WALLET_ID; do
+            jq -e --arg v "$v" 'any(.secrets[]; .name == $v and .required == true)' manifest.json > /dev/null \
+              || { echo "missing required secret: $v"; exit 1; }
+          done
+
           echo "manifest.json OK"
 
       - name: Validate .openclaw/openclaw.json

manifest.json

@@ -18,6 +18,28 @@
   "skills": [
     { "clawhub_slug": "opensea-marketplace", "name": "OpenSea" }
   ],
+  "secrets": [
+    {
+      "name": "OPENSEA_API_KEY",
+      "description": "OpenSea API key — used for all reads, fulfillment, and swaps. Get one instantly with: curl -s -X POST https://api.opensea.io/api/v2/auth/keys | jq -r .api_key",
+      "required": true
+    },
+    {
+      "name": "PRIVY_APP_ID",
+      "description": "Privy application ID. Create an app at https://dashboard.privy.io and copy the App ID.",
+      "required": true
+    },
+    {
+      "name": "PRIVY_APP_SECRET",
+      "description": "Privy application secret — same dashboard page as the App ID. Treat as a password.",
+      "required": true
+    },
+    {
+      "name": "PRIVY_WALLET_ID",
+      "description": "Privy server wallet ID. Create a server wallet (see skills/opensea/references/wallet-setup.md) and paste its id here.",
+      "required": true
+    }
+  ],
   "scripts": {
     "build": "npm install -g @opensea/cli"
   },