PayCrow

Escrow + trust scoring on Base mainnet. Checks 24K+ agents BEFORE you pay. Real dispute resolution. Works with any x402 API — vendor doesn't need it installed.

This skill is essentially a small client that calls a third-party Trust API; that design is coherent but has practical risks you should consider before relying on it for money transfers: - Verify the external service: inspect the linked GitHub repo (https://github.com/michu5696/paycrow), the npm package, and the deployed API (paycrow-app.fly.dev). Confirm the repo code, license, and whether the deployed endpoint matches the repo (source-to-deploy). Check commit history, maintainer reputation, and whether contracts are audited. - Privacy and leakage: every address you check is sent to paycrow-app.fly.dev. If you need privacy or don't want address-checks logged, run your own instance of the API or avoid using the skill. - Escrow caveat: the SKILL.md mentions an MCP server for escrow — that is separate software. Do not assume escrow protection without deploying and auditing that server and the on-chain contracts. Review the contract on BaseScan and verify bytecode/source matches the repo before trusting it with funds. - Treat scores as heuristics: the score is an aid, not a guarantee. For high-value payments, perform manual due diligence and consider multi-sig/escrow flows you control. If you decide to use the skill: test it with low-value transactions, confirm responses locally (curl) before automating, and prefer running your own instance of the service or self-hosting the MCP escrow component for production escrow use.

Type: OpenClaw Skill Name: paycrow Version: 1.2.4 The PayCrow skill is a utility designed to check the reputation of Ethereum addresses on the Base mainnet before a user or agent proceeds with a payment. It uses a standard curl command to query a trust score from a public API (paycrow-app.fly.dev) and provides clear, protective instructions for the agent to follow based on the result (e.g., warning the user if a score is low). No evidence of data exfiltration, malicious shell execution, or prompt injection was found; the logic is transparent and aligns with its stated purpose of fraud prevention.