tron-x402-payment

Pay for x402-enabled Agent endpoints using TRC20 tokens (USDT/USDD) on TRON

This skill implements on-chain TRC20 payments and therefore needs a TRON private key (and optionally a TronGrid API key for mainnet). Before installing or running: 1) Expect the tool to search environment variables and local files (~/.mcporter/mcporter.json, x402-config.json/.x402-config.json) for keys — if you keep other secrets in those files, the tool will read them. 2) Prefer supplying a dedicated ephemeral/testnet private key via TRON_PRIVATE_KEY (or use the --check mode) rather than storing your mainnet keys in shared configs. 3) Review the included dist/src code locally (it’s provided) and verify no unexpected network endpoints are contacted beyond the agent URL and TronGrid. 4) Be cautious about autonomous invocation: if the agent can call this skill without your confirmation, a compromised agent could attempt payments. 5) If unsure, test on nile/shasta with minimal funds and do not install on systems that store unrelated secrets in the checked config paths.

Type: OpenClaw Skill Name: tron-x402-payment Version: 1.0.0 This skill is classified as suspicious due to its handling of sensitive financial credentials and the execution of high-risk blockchain transactions. The `src/x402_tron_invoke.ts` script accesses the `TRON_PRIVATE_KEY` from environment variables and local configuration files (`~/.mcporter/mcporter.json`, `x402-config.json`), which is a sensitive operation. Furthermore, the skill is designed to perform TRC20 token payments, including an 'infinite approval' if the allowance is insufficient, which grants ongoing spending permission for the specified token. While the `SKILL.md` documentation and the TypeScript code include explicit security rules and sanitization to prevent private key leakage, the inherent risks associated with managing private keys and performing irreversible financial transactions warrant a 'suspicious' classification.