Near Getpay - Accept crypto payments with payment page using PingPay or HOT PAY

Accept crypto payments (NEAR, USDC, USDT) via a beautiful payment page with PingPay or HOT PAY integration.

What to consider before installing: - Secrets: Do NOT paste API keys or private keys directly into chat with an agent. Prefer adding them to the skill's .env file on your machine and keep the file local (gitignored). The SKILL.md example encourages pasting keys into chat — avoid that. - Required binaries: The runtime spawns 'npx', 'ts-node' and an 'ssh' reverse tunnel (localhost.run). Make sure those binaries are present and that you're comfortable exposing a local port via an external tunnel. - Sensitive keys: The skill may require PINGPAY_API_KEY and (for automated on-chain payments) NEAR account credentials/private key. Only give the minimum-permission API key and consider creating a test key or account. - Public exposure: The start script opens a public URL to your local server. Run this only from a machine you control and consider using a paid/protected tunnel (ngrok/Cloudflare Tunnel) rather than an ephemeral ssh tunnel if you need production stability. - Cross-skill import: The orchestrator dynamically imports '../near-intents' and calls executeIntent for swaps/bridges. If you intend to use that functionality, inspect the near-intents code (and keep private keys secure). If you don't need on-chain automation, limit configuration to PingPay/HOT PAY checkout-only flows. - Verify claims: Inspect .env.example, server code, and PingPay/HOT PAY integration endpoints to confirm behavior matches your expectations before running. If you want to be cautious, run the server in an isolated environment (container or VM) and do an npm install offline review of dependencies. If you want, I can: (a) point out the exact lines where secrets are read or sent, (b) show a safe workflow for running this skill without exposing secrets to chat, or (c) produce a checklist for running it in a sandbox/container.

Type: OpenClaw Skill Name: near-getpay Version: 1.0.0 The skill is classified as suspicious due to several security vulnerabilities and risky practices, despite its stated benign purpose of creating a crypto payment page. Key indicators include the `start-tunnel.ts` script disabling SSH host key checking (`-o StrictHostKeyChecking=no`), which makes the public tunnel vulnerable to man-in-the-middle attacks. Additionally, the `SKILL.md` and `README.md` documentation recommend generating SSH keys without a passphrase (`-N ""`) for `localhost.run` troubleshooting, which is a security weakness. Furthermore, the `server-simple.ts` file is vulnerable to self-XSS if the `RECIPIENT_ADDRESS` environment variable contains malicious HTML/JavaScript. While the `index.ts` file handles sensitive crypto transactions requiring a NEAR private key, this is for programmatic invoice *payment* (not the public payment page) and is explicitly documented, indicating a high-risk capability rather than direct malice.