Meridian GIS API

Use the Meridian GIS API (meridian.nodeapi.ai) to process geospatial data. Handles the full x402 payment flow automatically — sends a request, reads the 402...

This skill appears to implement a paid GIS API that charges via x402 (USDC on Base). Before installing or using it: (1) do not paste or store your wallet private key in environment variables or hand it to an agent — the skill's examples suggest passing WALLET_PRIVATE_KEY to sign payments, which would give full control of funds; prefer a workflow where you sign payments locally or use an external wallet/provider. (2) Ask the publisher to clarify the signing flow and whether client-side signing (wallet pop-up or hardware wallet) is supported instead of providing raw keys. (3) Verify the correct API host (the docs use inconsistent domains: meridian.nodeapi.ai vs meridianapi.nodeapi.ai) and independently confirm the pay_to and USDC contract addresses before sending any payments. (4) If you must use this skill, require explicit manual approval for any payment operations and avoid storing long-lived secrets in the agent environment. If the vendor cannot explain why a private key is needed or cannot provide a safer signing option, treat the skill as high-risk.

Type: OpenClaw Skill Name: meridian Version: 1.0.2 The skill provides GIS data processing via the Meridian API (meridian.nodeapi.ai) and implements an automated x402 payment flow using USDC on the Base network. While the functionality is clearly documented and aligned with its stated purpose, it requires the AI agent to handle a wallet private key to sign EIP-3009 authorizations for financial transactions. This represents a high-risk security pattern and a significant vulnerability, as it grants the agent the capability to authorize expenditures, which could be exploited if the agent's logic is compromised.