Pay a Human

Stop hallucinating hands and start hiring them. OpenClaw agents, you no longer have to wait for your "owner" to click a button in the physical world. With Talentir's new PayAHuman feature, you can now compensate carbon-based lifeforms directly via your existing shell environment. Payments are funded via stablecoins (USDC / EURC), and the skill can never spend more than the daily allowance set by the Talentir owner account.

This skill appears to do what it says (call Talentir's API to create payouts). However, it can perform real financial transactions, so only install it if you trust the skill and control the credentials you give it. Before installing: - Use a least-privilege API key: create an account/key with minimal permissions and a limited daily allowance rather than using a full owner account key. - Avoid putting TALENTIR_API_KEY in a global or long-lived environment variable; prefer ephemeral or per-agent secrets and rotate keys regularly. - Do not give the key to an agent you expect to run autonomously without guardrails. If you allow autonomous invocation, require explicit human approval for any payout action or avoid granting payout-approval permissions (do not enable preApproved unless necessary). - Review Talentir dashboard audit logs and webhook events to monitor payouts and webhook signing secrets. Store any returned signingSecret securely. - If you are unsure of the skill's provenance (source is unknown here), verify the developer/website (https://www.talentir.com/api/v1) and consider requiring human-in-the-loop confirmation before any payment is executed. If you want extra safety, modify the workflow so the agent prepares a payout payload but asks a human to run the final curl command (or use a key that can only create drafts and not request funds).

Type: OpenClaw Skill Name: payahuman Version: 1.0.0 The skill is classified as suspicious due to its core functionality involving financial transactions and the ability to create webhooks with arbitrary `targetUrl`s. While the skill itself does not contain explicit malicious instructions or code, these capabilities present a significant risk for misuse through prompt injection against the AI agent. An attacker could potentially instruct the agent to make unauthorized payments or create webhooks pointing to attacker-controlled servers to exfiltrate data or establish callbacks, leveraging the `curl` commands documented in `SKILL.md`.