FluxA Agent Wallet for x402 Resources Payment

A FluxA Agent Wallet skill that enables agents to request budgets, sign x402 payments, and call paid endpoints autonomously. It walks through the full flow—from mandate creation to X-PAYMENT execution—so agents can perform paid actions without human intervention.

Before installing or enabling this skill, consider the following: - The skill will contact external FluxA endpoints (agentid.fluxapay.xyz, walletapi.fluxapay.xyz, wallet.fluxapay.xyz by default) and will POST registration info (email, agent name, client info) and payment requests to those services. Verify you trust those endpoints and the skill author — no homepage or source is provided. - The bundle writes persistent files into your home directory (default: ~/.fluxa-ai-wallet-mcp/config.json and audit.log) and will store agent_id / token / jwt there. If you do not want credentials persisted on disk or want isolation, do not install or run it on a host with sensitive data; consider a disposable VM or container. - The runtime docs instruct the agent to auto-generate registration info and explicitly tell the agent not to ask the user for those fields. That behavior could lead to creating identities and requesting budgets/payments without explicit human-provided identity or stricter user confirmation. Require human approval before the skill registers an agent or requests budgets. - The registry metadata omits environment/config requirements even though the code reads many env vars and supports overriding endpoints and data directory. Ask the developer to update the manifest to declare required env vars and the config path, and to document network endpoints and what data is transmitted. - If you still want to use it, test in an isolated environment, inspect the bundled script yourself (it is provided), and restrict the skill from autonomous use (if the platform allows disabling autonomous invocation) until you trust it. If you cannot verify the FluxA endpoints or the author, do not enable the skill on production or on an account containing sensitive credentials. Confidence note: I am medium-confident because the behavior of the code aligns with the skill's described functionality, but the missing manifest declarations, the 'generate identity yourself' instruction, and the lack of a verifiable source/homepage raise non-trivial trust and privacy concerns. Additional information that would raise confidence to high: an authoritative source/homepage for the project, a signed/reputable publisher, explicit manifest entries listing env vars and config paths, and an explicit note in SKILL.md that the agent must get explicit user approval before creating/using an agent ID or spending funds.

Type: OpenClaw Skill Name: fluxa-x402-payment Version: 1.0.0 The skill bundle is designed for an AI agent to manage payments via the FluxA Wallet. The `SKILL.md` and other markdown files contain instructions for the agent, primarily focused on transparent communication with the user regarding budget requests and payment status, error handling, and secure agent ID initialization (generating parameters rather than asking the user). The `fluxa-cli.bundle.js` script handles agent registration, JWT management, and payment operations by communicating with legitimate FluxA API endpoints (agentid.fluxapay.xyz, walletapi.fluxapay.xyz) and storing configuration/audit logs in `~/.fluxa-ai-wallet-mcp`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation, and all actions are aligned with the stated purpose of a payment skill.