Pay For Service

Make a paid API request to an x402 endpoint with automatic USDC payment. Use when you or the user want to call a paid API, make an x402 request, use a paid service, or pay for an API call. Use after finding a service with search-for-service.

This skill is coherent with its stated purpose but exercise caution before using it: 1) Verify and trust the target x402 endpoint before sending requests — the command will perform real USDC payments. 2) Prefer pinning a specific vetted version of 'awal' (for example 'npx [email protected]' or installing a vetted binary) instead of 'awal@latest' to reduce supply-chain risk. 3) Confirm the wallet you will use is intended for these payments and contains only funds you are willing to spend; test with a small max-amount first. 4) Review the 'awal' package and its maintainers (npm page, repo, changelog) before executing remote code. 5) If you need stricter controls, run the command in an isolated environment or with a wallet that has limited funds/permissions. If you want, provide the 'awal' package version you trust or the environment where npx will run so the assessment can be updated.

Type: OpenClaw Skill Name: pay-for-service Version: 0.1.0 The skill is suspicious due to a high risk of shell injection and potential financial loss. The `SKILL.md` explicitly allows the agent to execute `npx awal@latest x402 pay` with arbitrary arguments via `Bash`. This command takes user-controlled inputs (URL, data, headers, query parameters) which, if not properly sanitized and shell-escaped by the agent, could lead to arbitrary command execution (RCE). The skill also involves making USDC payments, introducing a financial risk if the agent is prompted to make unauthorized or excessive transactions.