← 返回 Skills 市场
MoltsPay Skill
作者
Yaqing2023
· GitHub ↗
· v1.0.0
· MIT-0
424
总下载
0
收藏
0
当前安装
5
版本数
在 OpenClaw 中安装
/install moltspay-skill
功能描述
Pay for and use AI services via MoltsPay protocol. Trigger: User asks to generate video, use a paid service, etc. Auto-discovers services from /.well-known/a...
安全使用建议
This skill is plausible for paying AI services, but exercise caution before installing. Key points to consider:
- The skill will attempt to run npm install -g moltspay and run setup scripts automatically; that downloads and executes code from the npm registry. Only proceed if you trust the moltspay package and its maintainer (inspect https://github.com/Yaqing2023/moltspay and the npm package first).
- The setup auto-creates a wallet and writes ~/.moltspay/wallet.json (likely containing private keys/seeds). If you install, assume a new private key will be generated and stored locally. Do not fund that wallet with large amounts until you audit the code. Prefer funding with minimal test USDC first.
- The skill's metadata does not declare required binaries (node, npm, jq) even though scripts use them. Ensure your environment has these and understand the scripts that will run.
- To reduce risk: manually run and inspect scripts (scripts/setup.js, setup.sh) and review the moltspay npm package source before allowing automatic install; consider running the CLI in a contained environment (VM or container) and use a dedicated low-value wallet for payments.
- If you need a quick checklist: verify the npm package source, confirm where keys are stored and how seed/private key export/import works, and only fund the generated wallet after you are satisfied with the audit.
功能分析
Type: OpenClaw Skill
Name: moltspay-skill
Version: 1.0.0
The skill bundle automatically performs a global installation of an external npm package (`moltspay`) and initializes a cryptocurrency wallet in the user's home directory (`~/.moltspay`) via a `postinstall` script in `package.json` and `scripts/setup.js`. While these actions are consistent with the stated purpose of facilitating USDC payments for AI services, the automated global system modification and wallet creation without explicit runtime consent are high-risk behaviors. The skill also hardcodes specific external service providers (e.g., `juai8.com` and `moltspay.com`) for service discovery and payment execution.
能力评估
Purpose & Capability
The claimed purpose (paying for AI services via a MoltsPay CLI) matches the included code: scripts call a 'moltspay' CLI, discover services, and perform payments. However, the skill metadata declares no required binaries or environment variables even though the runtime scripts expect node/npm and (in some shells) jq, and the package will attempt to install the 'moltspay' npm package globally. The absence of declared runtime requirements is an inconsistency.
Instruction Scope
SKILL.md and scripts instruct the agent to run commands that install software (npm install -g moltspay), initialize a wallet, check balance, and pay provider URLs. These instructions create and store wallet data in ${HOME}/.moltspay/wallet.json (private key/seed likely) and cause network calls to moltspay.com and provider .well-known endpoints. The runtime instructions do not access unrelated system files, but they do direct the agent to perform global installs and automatic wallet initialization which may be surprising and has privacy/secret-management implications.
Install Mechanism
There is no formal install spec, but package.json contains setup/postinstall hooks and scripts (setup.js/setup.sh) that run 'npm install -g moltspay'. That triggers a global npm install from the public registry at install time — a moderate-to-high risk action because it fetches and runs third-party code without the user explicitly declaring acceptance. The install is traceable (npm) but still heavier than the metadata suggests.
Credentials
The skill declares no required environment variables or credentials, which is coherent at a surface level. However it will create and store wallet state (likely private keys) under ~/.moltspay. A payments skill legitimately needs to manage keys, but the skill does not document or request explicit user consent before wallet generation. Also the shell helper references 'jq' for JSON parsing, but jq is not listed as a required binary.
Persistence & Privilege
The skill will persist wallet data in the user's home directory (~/.moltspay) and triggers global installation of the 'moltspay' CLI — both are persistent effects. 'always' is false (good), but the postinstall/setup hooks will run automatically on install which results in persistent files and potentially generated secrets. This persistent presence combined with automatic wallet creation increases risk if the upstream CLI or package is malicious or compromised.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install moltspay-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/moltspay-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
MoltsPay Skill version 1.0.0
- Simplified wallet model: Only Base chain is now supported (USDC, gasless).
- Updated all commands and instructions to focus on single-chain usage.
- New API-driven service discovery via moltspay.com endpoints.
- Streamlined provider and service table formatting for user-facing outputs.
- Removed references to multi-chain, tokens, and QR code funding flows.
- Improved error handling and funding instructions for clarity.
v0.1.3
molstpay-skill v0.1.3 Changelog
- Added `moltspay fund <amount>` command: enables wallet top-up via QR code, supporting debit card/Apple Pay.
- Updated wallet funding instructions: QR code/card payments now recommended as the easiest option.
- Updated documentation to highlight fast, crypto-free wallet funding with USDC arriving in minutes.
- Expanded funding section to include both QR code and direct transfer methods.
- No other command or functional changes.
v0.1.2
MoltsPay Skill 0.1.2
- Added multi-chain support: use same wallet on Base and Polygon chains; supports USDC and USDT.
- Updated commands: `moltspay init` works across all chains, and new `moltspay services` command lists services from providers or marketplace.
- Balance and payments are now chain-specific; instructions and status reporting updated accordingly.
- Service discovery and payment flows improved, with clearer user guidance for funding and paying on different chains.
- Enhanced error handling for multi-chain usage, including chain mismatch and multi-chain prompts.
v0.1.1
MoltsPay Skill v0.1.1 Changelog
- Simplified and reorganized documentation for clarity and easier onboarding.
- Added a summary of available CLI commands in a concise table.
- Clarified wallet setup process and emphasized Base chain funding.
- Improved instructions for discovering and formatting service listings.
- Streamlined payment, spending limits, and error handling sections.
- Updated resource links and removed redundant explanations.
v0.1.0
MoltsPay Skill v0.1.0 — Initial Release
- Enables users to pay for and use AI services with USDC on Base chain (no gas required).
- Auto-discovers and lists paid AI services via /.well-known/agent-services.json and public APIs.
- Supports wallet setup, balance checks, payment history, and modifying spending limits.
- Guides users to fund their wallet and handles transaction errors with clear instructions.
- Formats service discovery results clearly—never shows raw JSON.
- Provides step-by-step flows for common actions like generating AI video or checking wallet status.
元数据
常见问题
MoltsPay Skill 是什么？
Pay for and use AI services via MoltsPay protocol. Trigger: User asks to generate video, use a paid service, etc. Auto-discovers services from /.well-known/a... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 424 次。
如何安装 MoltsPay Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install moltspay-skill」即可一键安装，无需额外配置。
MoltsPay Skill 是免费的吗？
是的，MoltsPay Skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
MoltsPay Skill 支持哪些平台？
MoltsPay Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 MoltsPay Skill？
由 Yaqing2023（@yaqing2023）开发并维护，当前版本 v1.0.0。
推荐 Skills