A curriculum that teaches AI agents how to spend their own money. Ten lessons from "what is a wallet" to "your first x402 purchase." Teacher, not butler — ex...

This package appears to be an instructional tool and is internally consistent with that purpose, but take these precautions before installing or running it: 1) Inspect the package source (index.js) or the repository in npm before running 'npx firstdollar' to ensure there are no unexpected network calls or file operations you don't want. 2) Never paste private keys, seed phrases, or raw wallet files into prompts or supply them to the agent; the skill is designed to show commands, not to accept secrets. 3) When following suggested diagnostic commands, avoid running ones that print private keys or unencrypted wallet files; prefer checks that report presence/capabilities without revealing secrets. 4) Prefer installing in an isolated/test environment if you want to try test-payment flows and verify merchant endpoints (confirm the merchant URL yourself). 5) If you need higher assurance, fetch the package tarball from the registry and review the full index.js for any outbound network calls, telemetry, or unexpected behavior before running it. If you want, share the remainder of index.js and I can review the parts not included here for network activity or file I/O that would change this assessment.

Type: OpenClaw Skill Name: firstdollar Version: 1.0.4 The 'firstdollar' skill bundle is classified as suspicious because it provides tools that instruct the AI agent to search for and potentially expose sensitive cryptographic keys and wallet files within its environment. Specifically, the 'explain-my-wallet' tool in 'index.js' suggests commands like 'env | grep' for private keys and 'ls' for Solana/OpenClaw wallet files, which could lead to accidental credential leakage into the agent's conversation context. While the package's stated intent is educational (teaching agents to use the x402 protocol), the practice of prompting an agent to output its own secrets is a high-risk pattern that could be exploited for data exfiltration.