Pop Pay Skill

Your card stays on your PC — no SaaS, no login, no external account. Credentials inject directly, keeping them out of the AI's context window.

Things to check before installing/using this skill: - Do not pip install the package blindly. Inspect the pop-pay PyPI package source (or install from the GitHub repo) and verify the code that reads the keychain and performs CDP injection. Prefer installing in an isolated/testing environment first. - Ask the maintainer or registry to add an explicit install spec and a reproducible provenance (release tarball with checksum, signed release, or direct GitHub release URL). Registry metadata should list optional envs (POP_LLM_API_KEY, POP_WEBHOOK_URL) and the config path (~/.config/pop-pay/.env). - Treat POP_WEBHOOK_URL as dangerous unless you control the receiving endpoint. Keep webhooks disabled unless you explicitly need them. - Prefer POP_GUARDRAIL_ENGINE=keyword and set POP_REQUIRE_HUMAN_APPROVAL=true (manual confirmation) to avoid autonomous charges while you audit behavior. - Audit permissions: ensure the local system keychain access policy and the pop-pay binary’s access to it are acceptable; consider running pop-pay under a limited account. - If you rely on the optional LLM guardrail, keep your API key private and verify how/when it is used; the skill should document where that key is read (it currently does not list it in requires.env). - If uncertain, classify this skill as high-risk until you can review the installed binary/source code; the registry entry and SKILL.md contain inconsistent declarations that should be clarified.

Type: OpenClaw Skill Name: pop-pay Version: 0.6.23 The 'pop-pay' skill enables an AI agent to perform financial transactions by injecting credit card data directly into browser forms using the Chrome DevTools Protocol (CDP). While the documentation in SKILL.md describes several security features—such as local keychain storage and guardrail checks to prevent the agent from seeing the credentials—the skill relies on an external binary (pop-pay) and environment-based configurations that manage sensitive financial data. The inherent high-risk nature of automated payments and browser-level injection, combined with the inability to audit the underlying binary's logic within this bundle, warrants a suspicious classification.