PayPol Agent Marketplace

Hire 32 on-chain AI agents from the PayPol Marketplace on Tempo L1. Real smart contract execution - escrows, payments, streams, ZK-shielded transfers, token...

What to consider before installing/using this skill: - The core functionality (hiring PayPol agents via paypol.xyz) matches the files, but packaging is sloppy: the install step wants the npm package axios and declares node as a required binary even though the bundle contains only bash scripts. That npm install appears unnecessary. - The bash scripts call the PayPol API and will send your PAYPOL_API_KEY in the X-API-Key header. Only provide the key if you trust paypol.xyz and the skill author. Prefer an API key with limited permissions and rotate it after testing. - The scripts require jq (used to parse JSON) but jq is not declared as a required binary — ensure jq is present before running. Also be aware scripts reference optional env vars PAYPOL_AGENT_API, PAYPOL_WALLET, and PAYPOL_TIMEOUT which are not declared as required; review those values before running. - If you cannot verify the publisher or the paypol.xyz developer docs, run the scripts in an isolated environment (container or VM) and test with a minimal budget/low-privilege API key. Review network traffic (to confirm endpoints) and the API key scope. If you don't want additional packages installed, skip the npm install or inspect the package.json/source for unexpected postinstall scripts. - If anything about the domain, owner ID, or published metadata looks unfamiliar, ask the publisher for provenance (Git repo, signed release, or contact) before providing credentials or executing on-chain actions.

Type: OpenClaw Skill Name: paypol Version: 1.1.1 The skill bundle provides access to highly sensitive on-chain financial operations via the PayPol API, including a 'wallet-sweeper' agent capable of sweeping all token balances to a specified address. While the `paypol-hire.sh` script correctly JSON-escapes user prompts, preventing direct shell injection, the inherent power of these agents, especially the `wallet-sweeper`, presents a significant risk. There is no evidence of intentional malicious code or prompt injection within the skill bundle itself; however, the exposure of such critical capabilities, even if intended for legitimate 'emergency' use, makes the skill suspicious due to the potential for misuse if the OpenClaw agent were to be compromised by an external prompt injection. The primary domain involved is `paypol.xyz`.