x402 Payment Protocol

Pay for resources via the x402 HTTP payment protocol using gasless USDC transfers on Base without accounts or KYC, enabling cryptographic identity-based access.

This skill implements the x402 payment flow and will need access to a wallet private key (PRIVATE_KEY) or a wallet file (WALLET_PATH) to sign EIP-3009 authorizations. The registry metadata failing to declare those sensitive env vars is an incoherence you should treat as a red flag. Before using: (1) do not paste your private key into untrusted UIs — prefer hardware wallets or short-lived keys; (2) inspect the x402.mjs code yourself or run it in an isolated environment; (3) if you must provide a key, consider creating a dedicated wallet with minimal funds and strict spending limits; (4) verify the USDC contract addresses and provider endpoints (conway.tech) against official sources; (5) be cautious that giving an agent a private key enables it to sign arbitrary authorizations — only proceed if you fully trust the code and the environment.

Type: OpenClaw Skill Name: x402 Version: 1.0.0 The skill implements the x402 protocol for automated USDC payments on the Base network, which involves high-risk operations such as handling private keys and signing EIP-3009 transactions. While the behavior is aligned with its stated purpose, the implementation in `x402.mjs` automatically signs payment authorizations based on parameters (amount, recipient) provided by the remote server in a 402 response. This creates a vulnerability where a malicious server could potentially trick an agent into signing unauthorized or excessive payments. No evidence of intentional credential theft or hardcoded malicious destinations was found.