multi-news-aggregator-via x402

Agent skill for x402-paid global news aggregation and source/time-filtered search.

This skill's documentation asks your agent to use a raw EVM private key to sign payments but the registry metadata does not declare any required credentials — that's an inconsistency and a security risk. Do not put a full/private blockchain key (EVM_PRIVATE_KEY) in the agent environment unless you fully trust the publisher. If you need this capability: (1) require the publisher to declare required env vars and provide a verifiable homepage/source; (2) prefer using a separate signing service or hardware wallet that can approve signatures interactively; (3) if you must supply a key, use an ephemeral/minimal-funds account that can only cover expected payments; (4) verify the API base (https://www.x402api.app/) and confirm the payment protocol with the service provider; (5) ask the publisher to fix the inconsistent env var names and to clearly explain why a raw private key is required. If you cannot validate the publisher or the payment design, avoid installing or enabling this skill with access to any real private key or funds.

Type: OpenClaw Skill Name: multi-news-aggregator Version: 1.0.0 The skill requires the user to provide an 'EVM_PRIVATE_KEY' in environment variables to facilitate a 'pay-per-call' mechanism for news searches via the domain 'www.x402api.app'. While the provided TypeScript code in SKILL.md uses the key locally for signing transactions via the 'viem' library, the requirement of a raw private key for a news aggregation service is a high-risk pattern that creates a significant attack surface for credential theft or unauthorized financial transactions if the underlying libraries or the API endpoint are compromised.