moneydevkit

Accept payments on any website using moneydevkit. Use when building a site that sells something, adding a checkout/paywall, or integrating payments into a Ne...

This skill appears to do what it says, but it requires a wallet seed phrase (MDK_MNEMONIC), which grants full control of funds — treat it like a private key. Before installing: (1) Verify the moneydevkit npm packages and the vendor (check the npm org, GitHub repo, and HTTPS docs) rather than trusting the skill metadata alone. (2) Prefer testing on signet/testnet and with disposable wallets. (3) If possible, avoid handing a raw mnemonic to third-party hosted services; use limited-scope API keys, hardware wallets, or a separate custody solution. (4) Store secrets in a secrets manager or platform env vars (never commit to git, never paste in chat). (5) If you must use a mnemonic, isolate it to a dedicated app and be prepared to rotate/rotate API keys and regenerate a new wallet if compromised. (6) Audit any @moneydevkit package code you install locally before running it.

Type: OpenClaw Skill Name: moneydevkit Version: 0.2.0 The OpenClaw AgentSkills skill bundle for 'moneydevkit' is benign. It provides documentation and code snippets for integrating a payment system, requiring sensitive credentials like `MDK_MNEMONIC` (a wallet seed phrase) and `MDK_ACCESS_TOKEN`. However, the `SKILL.md` file explicitly warns users about the critical importance of securing these credentials, advising against logging them or committing them to git, and recommending environment variables or secrets managers. All commands and instructions, including those for the agent (e.g., `claude mcp`, `npx @moneydevkit/create`), are directly related to setting up and managing the moneydevkit service. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent designed to cause harm beyond the stated purpose.