← Back to Skills Marketplace
66
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install lobpay
Description
Purchase items, pay merchants, retrieve checkout info, record transactions, and leave feedback via X402 protocol on the Base network using LobPay.
README (SKILL.md)
🦞 LobPay Agent Skill
AI-powered commerce via X402 protocol on Base network.
🚀 Quick Start
cd ~/.openclaw/workspace/skills/lobpay/scripts
npm install
🔧 Configuration
Set environment variables (optional):
LOBPAY_API_URL=https://lobpay.cash # Default: https://lobpay.market
📋 Core Workflows
1. Purchase Items
Get checkout info first:
node checkout.js \x3Cproduct_id> [quantity]
Then complete purchase:
node purchase.js \x3Cproduct_id> [quantity]
Combined quick purchase:
node buy.js \x3Cproduct_id> [quantity]
2. Leave Feedback
# Rate last purchase
node feedback.js \x3Crating> "\x3Ccomment>"
# Rate specific transaction
node feedback.js \x3Ctransaction_id> \x3Crating> "\x3Ccomment>"
3. View Purchase History
node history.js [limit]
🔗 API Endpoints
| Endpoint | Method | Auth | Purpose |
|---|---|---|---|
/api/v1/public/checkout-info |
GET | Public | Get pricing & merchant wallet |
/api/v1/agents/purchase |
POST | API Key + X402 | Execute purchase |
/api/v1/agents/feedback |
POST | API Key | Leave rating/comment |
/api/v1/agents/history |
GET | API Key | View transactions |
💰 X402 Payment Flow
- Checkout → Get merchant wallet + pricing
- Sign → Create X402 payment header
- Purchase → Send to
/agents/purchasewith payment proof - Confirm → Transaction recorded on Base
See references/api.md for detailed request/response schemas.
🛡️ Security
- Private keys stored in
~/.lobpay/config.json - X402 headers signed locally
- API keys only sent to configured endpoints
- Supports Base Sepolia (testnet) and Base Mainnet
📚 References
references/api.md- Full API documentationreferences/schemas.md- Database schemasreferences/x402.md- X402 protocol details
Usage Guidance
Install only if you are comfortable giving this skill a dedicated wallet private key and API key. Use a low-balance test wallet first, verify the API endpoint before use, require explicit confirmation before every purchase, and avoid using mainnet or high-value funds until the dependency versions, credential storage, and spending controls are improved.
Capability Analysis
Type: OpenClaw Skill
Name: lobpay
Version: 1.0.0
The LobPay skill facilitates automated commerce via the X402 protocol on the Base network, but it employs high-risk security practices for handling sensitive credentials. Specifically, `register.js` accepts a plaintext private key as a command-line argument and stores it, along with an API key, in an unencrypted JSON file at `~/.lobpay/config.json`. While these capabilities are plausibly needed for the stated purpose of local transaction signing, they represent significant security vulnerabilities (exposure via process monitoring and insecure local storage). The core logic in `buy.js` and `purchase.js` appears to correctly implement the X402 payment flow using the `viem` library, and no evidence of intentional data exfiltration or malicious command execution was found.
Capability Tags
Capability Assessment
Purpose & Capability
The stated purpose is coherent with the code: it retrieves checkout data, signs X402 payments, submits purchases, stores history, and leaves feedback. However, those are high-impact financial/account actions and the artifacts do not define spending caps, merchant allowlists, rollback behavior, or a required final user confirmation before purchase.
Instruction Scope
The skill documents direct purchase commands including a combined quick-buy flow, and the scripts execute the payment request once invoked. The instructions do not clearly require the agent to stop for user approval after showing price/merchant details.
Install Mechanism
The skill is described as instruction-only, but SKILL.md tells users to run npm install and package.json uses version ranges for payment/wallet-related dependencies. This is expected for a Node-based payment integration, but users should audit and pin dependencies before using a real wallet.
Credentials
Registry requirements declare no credentials, environment variables, or config paths, while the code requires a private key and API key in ~/.lobpay/config.json and supports an endpoint-changing LOBPAY_API_URL. The documented default API URL also differs from the code default.
Persistence & Privilege
The skill persists raw wallet private keys and API keys in a local JSON file, then reuses them to sign payments and authenticate API calls. It also stores local checkout and purchase history.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install lobpay - After installation, invoke the skill by name or use
/lobpay - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
lobpay 1.0.0
- Initial release of the LobPay Agent Skill, enabling item purchases via the X402 protocol on the Base network.
- Supports product checkout, X402-based payment, purchase history viewing, and merchant feedback/rating.
- Provides CLI scripts for checkout info retrieval, purchase, quick buy, feedback submission, and transaction history.
- Integrates with LobPay API endpoints for commerce workflows and secure payment confirmation.
- Includes configuration for environment variables, security best practices, and reference documentation.
Metadata
Frequently Asked Questions
What is LobPay?
Purchase items, pay merchants, retrieve checkout info, record transactions, and leave feedback via X402 protocol on the Base network using LobPay. It is an AI Agent Skill for Claude Code / OpenClaw, with 66 downloads so far.
How do I install LobPay?
Run "/install lobpay" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is LobPay free?
Yes, LobPay is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does LobPay support?
LobPay is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created LobPay?
It is built and maintained by Amir (@web3senior); the current version is v1.0.0.
More Skills