Zinc Universal Checkout

Place, list, and retrieve orders via the Zinc API (zinc.com). Use when the user wants to buy a product from an online retailer, check order status, list recent orders, or anything involving the Zinc e-commerce ordering API. Requires ZINC_API_KEY environment variable.

This skill is internally consistent with its stated purpose of interacting with the Zinc API and is instruction-only (no install or code), but check these before installing: 1) Provide a ZINC_API_KEY from app.zinc.com; prefer setting it as an environment variable rather than embedding it in ~/.openclaw/openclaw.json or other plaintext files. 2) Confirm the agent will always ask the user before POSTing orders (SKILL.md says it should) — if your agent can act autonomously, restrict that when money is involved. 3) Be aware the skill schedules follow-up checks and posts announcements to channels; if you don't want automated messages, limit the agent's scheduler/messaging permissions. 4) The package metadata omitted the required env var — verify the runtime will actually be given the API key (and not left unset). If you need stronger assurance, ask the skill author for a signed/official source or a repository link.

Type: OpenClaw Skill Name: universal-checkout Version: 1.0.1 The skill is designed for managing e-commerce orders via the Zinc API, requiring an API key for authentication. All instructions and examples, including `curl` commands in `SKILL.md`, are directed at the legitimate `api.zinc.com` endpoint. The skill explicitly includes safety instructions for the AI agent, such as requiring user confirmation before placing orders and validating `max_price`, which mitigates financial risks. The 'cron job' example in `SKILL.md` is an agent-internal scheduled task for order status polling, with a benign payload, not a system-level persistence mechanism or arbitrary command execution. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized parties, backdoors, or harmful prompt injection.