Sardis Cards

Virtual card issuance and management for AI agents to make real-world purchases

This skill appears to do what it says (manage virtual cards) and only asks for a SARDIS_API_KEY, which is appropriate. Before installing: 1) Verify the npm package '@sardis/sdk' and the domain https://sardis.sh are legitimate and trustworthy — the SKILL.md references an npm install even though the registry entry shows no install spec. 2) If you allow the SDK to be installed, review its code or use a scoped/trusted package mirror. 3) Limit autonomous invocation or require manual confirmation for actions that create cards or call the 'reveal' endpoint (full card numbers/CVV); otherwise an agent could create cards or expose sensitive data without oversight. 4) Keep the SARDIS_API_KEY secret, rotate it if compromised, and do not paste it into logs or public channels. 5) Note the examples use bc for numeric checks but bc is not listed as required; ensure your runtime has needed binaries. If you want a lower-risk install, ask the skill author to: include a clear install spec in the registry, declare all required binaries, and document the exact npm package version or provide a vetted SDK.

Type: OpenClaw Skill Name: sardis-cards Version: 1.0.0 The sardis-cards skill provides a legitimate interface for managing virtual payment cards via the Sardis API (api.sardis.sh). The documentation (SKILL.md) includes strong security guardrails, explicitly instructing the AI agent to never log full card numbers, enforce spending limits, and freeze cards upon detecting anomalies. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.