x402 (official examples)

Internet-native payments using the HTTP 402 Payment Required standard. Set up as a buyer to pay for API access, or as a seller to monetize your APIs.

This skill appears to be a legitimate guide for implementing HTTP 402 blockchain payments, but it expects you to use wallet private keys and call remote facilitator services. Before using or installing: (1) do not store your primary/private keys in a general-purpose agent environment — use a test/ephemeral wallet or a secure signer (hardware or dedicated signing service); (2) verify and vet any facilitator endpoints you will contact (use only well-known, audited providers); (3) when running the example npm installs, inspect the packages and their source repos; (4) ask the publisher for a homepage/source repository and an explicit list of required env vars in the registry metadata (the current metadata omits the private-key vars shown in SKILL.md); (5) avoid pasting real private keys into agent environments or chat windows. If you need higher assurance, request provenance (source repo, maintainer identity, or a signed release) before deploying this skill in a production environment.

Type: OpenClaw Skill Name: x402-enhanced Version: 1.0.1 The skill bundle is classified as suspicious due to its explicit instructions and code examples for handling highly sensitive cryptocurrency private keys (`EVM_PRIVATE_KEY`, `SVM_PRIVATE_KEY`) from environment variables within `SKILL.md`. While this is necessary for the stated purpose of internet-native payments, granting an AI agent direct access to and operational control over such credentials for financial transactions represents a significant inherent risk. Additionally, the skill involves making external network requests to various payment facilitators (e.g., `https://x402.org/facilitator`, `https://api.cdp.coinbase.com/platform/v2/x402`), which, while legitimate for the skill's function, adds to the overall risk profile of an autonomous agent operating with these capabilities.