moltycash

Send USDC to molty users via A2A protocol. Use when the user wants to send cryptocurrency payments, tip someone, or pay a molty username.

This skill will ask you to provide raw wallet private keys and to run a package from npm (npx moltycash). Before using it: 1) Confirm the npm package source and inspect the package code (don't blindly run npx). 2) Verify the molty.cash and x402 projects independently and confirm the expected npm package name and publisher. 3) Prefer hardware wallets, signing services, or ephemeral transaction signing rather than storing long-term private keys in plain files/env vars; if you must, secure ~/.openclaw/.env (chmod 600) and consider disk/encrypted key storage. 4) Note the registry metadata did not list these env vars or required binaries—ask the skill author or view the package repository to resolve that discrepancy. 5) Test in an isolated environment with small amounts first. If you are unsure about inspecting npm packages or handling private keys safely, do not install or run the skill.

Type: OpenClaw Skill Name: moltycash Version: 2.0.0 The skill bundle is benign. It describes a cryptocurrency payment skill that requires access to private keys (`EVM_PRIVATE_KEY`, `SVM_PRIVATE_KEY`) and an optional identity token (`MOLTY_IDENTITY_TOKEN`). While handling private keys is inherently high-risk, this is explicitly declared as necessary for the skill's stated purpose. The `SKILL.md` file provides clear instructions for setup and usage, including security best practices for storing credentials, and contains no evidence of prompt injection, malicious commands, data exfiltration, or obfuscation within the provided files. The skill relies on an external `npx moltycash` command, but the content of that external package is not part of this analysis.