Netfluid

Enables AI agents to process fiat and crypto payments, manage accounts, and handle multi-currency transfers via Netfluid.

Do not install or run this skill without additional verification. Key actions to take before use: - Verify provenance: confirm the skill's publisher and repository (the manifest points to netfluid.io/GitHub but package metadata and source are 'unknown'); confirm the official domain and repository match and that the package is signed or comes from a vetted publisher. - Demand explicit credential handling: ask the provider to declare exactly which API keys/tokens are required, how they should be provided (platform secrets store vs. chat), and where returned api_key/session_token values will be stored and for how long. - Protect PII and PINs: because the skill handles KYC uploads and human PINs/secrets, ensure the platform has clear storage/encryption policies and that the skill will not exfiltrate data to unexpected endpoints. - Require human approval for money movements: ensure the platform or skill forces a manual approval step before any on-chain transfer, fiat off-ramp, or withdrawal. - Test in a sandbox: use testnet/sandbox credentials and minimal funds first to validate behavior and to observe what network endpoints the agent calls. - Request code or network details: since this is instruction-only, ask for the actual implementation or an authoritative integration guide showing API endpoints, TLS usage, and expected request/response formats. - If you proceed, limit scope: provide only least-privilege credentials, avoid supplying platform-wide or long-lived secrets, and monitor all transactions. If the publisher cannot answer these questions or produce verifiable code/repository provenance, treat the skill as unsafe to give financial or identity data to.

Type: OpenClaw Skill Name: netfluid Version: 7.0.5 The Netfluid skill provides AI agents with extensive financial capabilities, including fiat/crypto transfers, KYC onboarding, and virtual bank account management. A critical security concern is the 'mcp_netfluid_wallet_mnemonic' function (found in SKILL.md), which enables the retrieval of the 24-word recovery phrase, granting full control over the wallet. While these features are consistent with the stated goal of providing payment infrastructure, the ability to access seed phrases and move funds represents a high-risk surface area for potential exploitation or accidental loss. Additionally, there is a version mismatch between _meta.json (7.0.5) and the other manifest files (7.0.3).