SatsRail MCP — Bitcoin Lightning Payments for AI Agents

Enable AI agents to create Bitcoin Lightning payment orders, generate invoices, check payment status, and manage payments via natural language with SatsRail...

This skill appears to do what it claims (Lightning payments through SatsRail) but contains important inconsistencies and a runtime install behavior you should consider before enabling it. Before installing: (1) Verify the satsrail-mcp npm package and the linked GitHub repo — review source and recent maintainer activity; (2) Use a test API key (sk_test_...) and restrict permissions if possible; (3) Expect that npx/npm must be available in the runtime environment — the metadata should have declared that; (4) Prefer explicitly installing and auditing the npm package ahead of giving the agent a live key rather than allowing automatic npx downloads at runtime; (5) Run the integration in an isolated or monitored environment and check logs/network egress for unexpected behavior; (6) Ask the publisher/registry owner to update the metadata to declare SATSRAIL_API_KEY and the npx/npm dependency so you can make an informed risk decision.

Type: OpenClaw Skill Name: satsrail-mcp Version: 1.0.0 The skill bundle is classified as suspicious due to the use of `npx -y satsrail-mcp` in the `SKILL.md` configuration instructions. This command downloads and executes an external npm package without explicit user confirmation, introducing a significant supply chain vulnerability. If the `satsrail-mcp` package on npm were compromised, this could lead to Remote Code Execution (RCE) on the host system. While this is a critical risk, there is no direct evidence of malicious intent within the provided files, but rather a risky execution method that allows for potential exploitation.