← Back to Skills Marketplace
101
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install query-payful-account
Description
Query Payful account information including balance, transactions, and account details. Use when the user needs to check their Payful account status, view bal...
Usage Guidance
This skill appears to do what it says (query Payful account balance) and the code is straightforward, but proceed with caution. Key points to consider before installing or running:
- The SKILL.md and script require two sensitive environment variables containing browser session cookies (PAYFUL_TOKEN and PAYFUL_USER_ID). These grant full account access; only set them in a trusted, private environment.
- The registry metadata omitted these required env vars/primary credential—ask the publisher why the metadata and SKILL.md disagree before trusting the package.
- The script can be pointed at an arbitrary --api-url; only run it against servers you trust (the default is global.payful.com). Malicious actors could instruct you to use a custom URL to capture credentials.
- Prefer using scoped API credentials (if Payful provides them) instead of raw session cookies. If you must use cookies, set them in a temporary environment and avoid sharing or storing them in shared shells or CI.
If you cannot verify the publisher or the metadata mismatch, treat this as suspicious and avoid supplying your account cookies.
Capability Analysis
Type: OpenClaw Skill
Name: query-payful-account
Version: 1.0.1
The skill is designed to query account balances from the Payful financial service. The script `scripts/query_balance.py` uses standard Python libraries to make authenticated GET requests to the official Payful API (global.payful.com) using session cookies provided via environment variables. The code is transparent, includes appropriate security warnings in `SKILL.md`, and lacks any indicators of malicious intent, data exfiltration to unauthorized endpoints, or command injection vulnerabilities.
Capability Assessment
Purpose & Capability
The name/description, SKILL.md, and the included Python script consistently implement a Payful account query and legitimately require PAYFUL_TOKEN and PAYFUL_USER_ID (browser cookie values). However the registry metadata provided above claims there are no required env vars or primary credential — that mismatch between declared registry metadata and the skill's own SKILL.md/script is unexpected and should be questioned.
Instruction Scope
SKILL.md instructs only to set two env vars and run the included script. The script reads only PAYFUL_TOKEN and PAYFUL_USER_ID, calls the Payful API endpoint (or a user-supplied --api-url), and prints results. It does not access unrelated files, system paths, or external endpoints beyond the optional api-url parameter.
Install Mechanism
There is no install spec (instruction-only with a bundled script). Nothing is downloaded or written to disk beyond the included script, which is low risk from an install-mechanism perspective.
Credentials
The two environment variables requested are directly related to the task (they are session cookies used for authentication). They are highly sensitive (session-cookie style tokens). The SKILL.md marks PAYFUL_TOKEN as the primary credential, but the registry metadata above does not declare these env vars — this inconsistency is concerning because missing metadata can hide the need to supply secrets or cause accidental exposure if users set tokens in shared environments.
Persistence & Privilege
The skill does not request elevated persistence (always is false) and does not modify other skills or system settings. The default ability for the agent to invoke the skill autonomously remains, which is standard; there is no evidence of the skill attempting to persist credentials or reconfigure the agent.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install query-payful-account - After installation, invoke the skill by name or use
/query-payful-account - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Added explicit metadata describing required environment variables, including credential flags and descriptions.
- Included a security notice in the documentation, warning users about the sensitivity of PAYFUL_TOKEN and PAYFUL_USER_ID.
- No code changes; documentation and metadata improvements only.
v1.0.0
Initial release of the payful-query skill.
- Enables querying Payful account information, including balance, transactions, and account details.
- Requires PAYFUL_TOKEN and PAYFUL_USER_ID environment variables for authentication.
- Supports custom API endpoints via command-line arguments.
- Provides scripts for checking account balance and integration details.
- Returns structured JSON responses with balance and account data.
Metadata
Frequently Asked Questions
What is Query Payful Account?
Query Payful account information including balance, transactions, and account details. Use when the user needs to check their Payful account status, view bal... It is an AI Agent Skill for Claude Code / OpenClaw, with 101 downloads so far.
How do I install Query Payful Account?
Run "/install query-payful-account" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Query Payful Account free?
Yes, Query Payful Account is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Query Payful Account support?
Query Payful Account is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Query Payful Account?
It is built and maintained by Hugo Gu (@hugogu); the current version is v1.0.1.
More Skills