Obverse Payments

Create, track, and manage USDC/USDT stablecoin payment links for sales, fundraising, and invoices across Telegram, WhatsApp, and Discord with dashboards.

This skill appears to be what it claims: a payment-link tool that talks to the Obverse API. Before installing, confirm you trust the Obverse backend (https://obverse.cc and https://obverse.onrender.com) because customer emails, names, phone numbers and payment metadata will be sent to and stored there. Use a dedicated API key for each environment (dev vs prod) and do not commit keys into version control or shared config files; treat ~/.openclaw/openclaw.json as sensitive. Ensure your environment has curl and jq (package.json/clawhub.json reference them) or the shell helper may fail. If you plan to allow the agent to invoke the skill autonomously, be aware that an agent could create or manage payment links and thereby act on your behalf with that API key — only grant that ability if you trust the backend and have appropriate rate limits/monitoring in place. Finally, reconcile the small manifest inconsistency (required binaries listed in package.json/clawhub.json but not in registry metadata) and review the included scripts (obverse-cli.js and scripts/obverse-client.sh) yourself to be comfortable with their network calls and handling of data.

Type: OpenClaw Skill Name: obverse-payments Version: 1.0.1 The OpenClaw AgentSkills bundle 'obverse-payments' appears benign. Its core functionality involves making authenticated API calls to an external payment processing service (`https://obverse.onrender.com` by default) using provided API keys. The `SKILL.md` and `README.md` contain clear instructions for the AI agent, consistently focused on payment-related tasks, with no evidence of prompt injection attempts to subvert agent behavior or exfiltrate unrelated data. The `obverse-cli.js` and `scripts/obverse-client.sh` primarily act as wrappers for these API calls, without executing arbitrary user-controlled input or engaging in malicious local system interactions. While the skill handles sensitive data like API keys and temporary dashboard credentials, this is part of its stated purpose, and the skill itself does not misuse them. The instructions for installing OpenClaw via `curl | bash` in the documentation are for the user/developer setting up the platform, not part of the skill's runtime or a malicious action by the skill itself.