Virtual MasterCards for AI agents — crypto payments, USDC wallet, create and manage virtual payment cards autonomously via x402 protocol on Stellar blockchain.

Key points to consider before installing or providing secrets: - This skill enables an agent to perform real payments and issue virtual MasterCards. If you supply a funded Stellar private key (ASG_CARD_WALLET_SECRET) the agent can spend real USDC. Only provide a key you explicitly trust the skill with. - There is an inconsistency: the SKILL/README claim the MCP server uses a local wallet file (~/.asgcard/wallet.json) and 'no env vars needed', yet the registry metadata marks ASG_CARD_WALLET_SECRET as required/primary. That should be clarified—don't assume where your secret will be read from or stored. - The code bundle includes many runnable scripts (CLI, mcp-server, e2e, preflight). Review those scripts locally before executing. They perform network calls to api.asgcard.dev and Stellar Horizon endpoints. - A prompt-injection pattern (unicode control characters) was detected in SKILL.md. Inspect SKILL.md raw bytes; do not blindly feed it to an agent or evaluation pipeline without sanitization. Practical mitigations: - Use a dedicated, low-funded Stellar wallet for experiments. Do not use high-value keys or production treasury keys. - Prefer the local wallet file workflow (created by onboarding) over exporting a private key into global environment variables. If the skill truly needs ASG_CARD_WALLET_SECRET, prefer injecting it only into a tightly-scoped runtime environment and remove it afterwards. - Audit the onboarding CLI and mcp-server code (cli/src/wallet-client.ts, mcp-server/src/wallet-client.ts, and api/src/middleware/walletAuth.ts) to confirm where and how secrets are read, stored, and transmitted. - If you expect the skill to act autonomously, set strict spending limits at the issuer/facilitator level and monitor transactions closely. Consider adding an approval step in the agent flow (require human approval before spending beyond trivial amounts). - If you cannot audit the code or vendor, do not provide production keys; instead test with sandbox accounts. If you want, I can: (a) point to the exact files that read env vars and wallet files so you can inspect them, or (b) list the code paths that would sign or transmit transactions so you can review them in detail.

Type: OpenClaw Skill Name: agentcard Version: 0.2.0 The Agent Card skill bundle is a well-engineered and legitimate tool for managing virtual MasterCards via the Stellar blockchain. It implements several security best practices, including AES-256-GCM encryption for card details at rest (pgCardRepo.ts), Ed25519 signature verification for wallet authentication (walletAuth.ts), and strict log redaction of sensitive data like PANs and CVVs (logger.ts). The code logic is transparent, follows the x402 payment protocol, and includes robust anti-replay mechanisms using nonces and idempotency keys. No evidence of malicious intent, unauthorized data exfiltration, or prompt injection was found.