← Back to Skills Marketplace
cdermott7

Locus

by cdermott7 · GitHub ↗ · v1.3.0
cross-platform ⚠ suspicious
2262
Downloads
1
Stars
0
Active Installs
7
Versions
Install in OpenClaw
/install locus
Description
Locus payment tools for AI agents. Use when asked to send payments, check wallet balances, list tokens, approve token spending, or process payment-related actions from emails. Also use for demos of Locus (YC F25) payment infrastructure — scanning emails for payment requests and initiating crypto payments via wallet.
README (SKILL.md)

Locus Payment Skill

Locus connects AI agents to crypto wallets via MCP. Tools are dynamic — each user gets different tools based on their permission group.

Setup (Agent-Guided)

When the user asks to set up Locus, use payments, or anything payment-related — check if Locus is configured and walk them through setup interactively:

Step 1: Check if mcporter is installed

command -v mcporter || npm i -g mcporter

Step 2: Check if Locus is already configured

mcporter config get locus 2>/dev/null

If configured, skip to Usage. If the user wants to reconfigure, run:

mcporter config remove locus

Step 3: Ask the user for their API key

Tell them:

You'll need a Locus API key to connect your wallet. Get one at https://app.paywithlocus.com — each key is tied to your wallet and permission group. Paste it here when you're ready.

Wait for the user to provide their key. It should start with locus_. If it doesn't, warn them and confirm before proceeding.

Step 4: Configure mcporter

mcporter config add locus \
  --url "https://mcp.paywithlocus.com/mcp" \
  --header "Authorization=Bearer \x3CAPI_KEY>" \
  --scope home

Step 5: Verify the connection

mcporter list locus

If tools appear, setup is complete — tell the user they're ready. If it fails, ask them to double-check their API key and try again.

Alternative: Script-based setup

Users can also run the setup script directly from the Clawdbot workspace root:

bash skills/locus/scripts/setup.sh

Usage

Always discover available tools first:

mcporter list locus --schema

This returns all tools the user's permission group allows. Tools vary per user — do not assume which tools exist. Use the schema output to understand parameters.

Call any discovered tool:

mcporter call locus.\x3Ctool_name> param1=value1 param2=value2

For array/object parameters:

mcporter call locus.\x3Ctool_name> --args '{"key": "value"}'

Email → Payment Flow

  1. Scan inbox for payment-related emails (invoices, bills, splits, reimbursements)
  2. Identify actionable items with amounts, recipients, and context
  3. Summarize findings to user
  4. On user approval, execute payments via available tools
  5. Always confirm with user before sending any payment

Safety Rules

  • Never send payments without explicit user confirmation
  • Always show: recipient, token, amount, and memo before executing
  • Check available balance before attempting payments
  • Double-check recipient addresses — typos mean lost funds
  • Confirm large payments (>$100) with extra care
Usage Guidance
This skill appears to be a legitimate wrapper around the Locus payment MCP, but it asks the agent to scan your inbox for payment requests — a sensitive action that the SKILL.md does not explain how to perform or obtain permission for. Before installing or running it: (1) Verify the mcporter tool's origin and trustworthiness before allowing the script to install it globally. (2) Do not paste API keys or other secrets into public chats; prefer entering them in a secure prompt or setting them in a location you control. (3) Confirm how your agent will access email (what mailbox, what auth) and that you explicitly consent to giving mailbox access. (4) If you want tighter control, configure mcporter manually and avoid using the script; review where mcporter stores credentials. If you can, ask the skill author for explicit documentation of email access and storage practices before use.
Capability Analysis
Type: OpenClaw Skill Name: locus Version: 1.3.0 The skill bundle is designed to enable AI agents to perform crypto payments, which inherently involves high-risk operations. It installs a global package (`mcporter`) via `npm i -g` in `SKILL.md` and `scripts/setup.sh`, requiring elevated privileges. It also handles sensitive API keys for a payment service (`https://app.paywithlocus.com`) and implies access to email for payment processing. While the `SKILL.md` includes strong safety rules for the agent (e.g., 'Never send payments without explicit user confirmation'), the combination of global package installation, sensitive credential handling, and direct financial transaction capabilities without clear malicious intent pushes it into the 'suspicious' category due to the broad permissions and inherent risk.
Capability Assessment
Purpose & Capability
Name/description, mcporter configuration, and listed tools (list_tokens, send_token, approve_token) are coherent. The service endpoints referenced (app.paywithlocus.com, mcp.paywithlocus.com) match the stated purpose of connecting to Locus via MCP.
Instruction Scope
SKILL.md explicitly instructs the agent to 'scan inbox for payment-related emails' and extract actionable items. That operation is sensitive (reading user email) but the skill provides no mechanism, permissions model, or explicit user consent flow for mailbox access. It also gives broad discretion to identify actionable items — this is scope creep unless the agent already has a well-defined, consented email-access tool.
Install Mechanism
No install spec in the registry, but the included setup.sh will install mcporter via 'npm i -g mcporter' if missing. npm global installs are common but carry the usual risk of executing third-party code; this is proportional to the stated need for mcporter, but users should verify mcporter's provenance before installing globally.
Credentials
The skill does not declare required env vars and asks the user interactively for a Locus API key (prefix locus_). Asking for an API key is expected, but the registry metadata omits any 'primary credential' declaration. The instructions also tell the user to paste the API key into the interactive flow (or chat) — users should avoid pasting secrets into channels that are not secure.
Persistence & Privilege
always is false and the skill does not request system-wide privileges or modify other skills. The setup stores config via mcporter, which is expected behavior and limited in scope.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install locus
  3. After installation, invoke the skill by name or use /locus
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.3.0
Agent-guided interactive setup: agent walks user through each step conversationally instead of just pointing to a script
v1.2.2
Added README with quick start and manual setup instructions
v1.2.1
Clarified setup path after install
v1.2.0
Fix: user-facing API key URL updated to app.paywithlocus.com
v1.1.0
Simplified skill: removed hardcoded tool docs, tools are discovered dynamically from MCP. Removed api.md — agent discovers tools via mcporter list.
v1.0.1
Remove MCP server URL prompt from setup — always uses production
v1.0.0
Locus payment tools for AI agents — send crypto, scan emails for invoices, split bills. Connect any AI agent to a Locus wallet via MCP.
Metadata
Slug locus
Version 1.3.0
License
All-time Installs 0
Active Installs 0
Total Versions 7
Frequently Asked Questions

What is Locus?

Locus payment tools for AI agents. Use when asked to send payments, check wallet balances, list tokens, approve token spending, or process payment-related actions from emails. Also use for demos of Locus (YC F25) payment infrastructure — scanning emails for payment requests and initiating crypto payments via wallet. It is an AI Agent Skill for Claude Code / OpenClaw, with 2262 downloads so far.

How do I install Locus?

Run "/install locus" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Locus free?

Yes, Locus is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Locus support?

Locus is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Locus?

It is built and maintained by cdermott7 (@cdermott7); the current version is v1.3.0.

💬 Comments