openkrill

Enable AI agents to make micropayments via x402 protocol. Use when purchasing browser sessions on Browserbase, scraping with Firecrawl, or any x402-compatible API. Handles wallet creation, funding, and automatic payment flows.

What to consider before installing: - The skill legitimately needs a thirdweb project secret key (THIRDWEB_SECRET_KEY). That key can create/manage wallets and invoke payments — only provide it if you trust the code and are prepared for potential charges. Prefer using a dedicated thirdweb project with limited funds/billing alerts rather than a production key. - The package contains TypeScript scripts that expect Node.js/ts-node (shebang uses npx ts-node). The skill metadata didn't declare this; running scripts may cause npx to fetch packages from the npm registry at runtime. If you plan to run the scripts, install Node/ts-node locally and inspect the code rather than relying on npx to pull remote packages. - create-email.ts stores disposable email credentials in .agent-emails.json in the current working directory (unencrypted). If you use the email automation, review and securely delete or move that file if it contains data you don't want persisted. - Financial risk: the skill can initiate payment flows via thirdweb. Test on a testnet or isolated project with a small budget before using on mainnet. Configure billing alerts and limits on your thirdweb/account to avoid unexpected charges. - If you need stronger guarantees, review the code yourself (it's provided), run in an isolated environment, and rotate the THIRDWEB_SECRET_KEY after testing. Consider disabling autonomous invocation for agents that you don't fully trust to prevent unattended spending or email/account creation.

Type: OpenClaw Skill Name: openkrill Version: 1.0.0 The skill bundle is designed to enable AI agents to make micropayments via the x402 protocol and manage disposable email accounts. All network access (to thirdweb API, x402 Bazaar, Mail.tm, and blockchain RPCs) and file operations (writing to a local, gitignored `.agent-emails.json` for email credentials) are directly aligned with the stated purpose. The `SKILL.md` instructions guide the agent to use these capabilities for their intended function, including opening payment links in the user's browser for funding, which is a legitimate interaction. There is no evidence of intentional harmful behavior, data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts to subvert the agent's core directives.