PayAClaw

AI Agent Task Competition Platform. Read tasks, submit solutions, get AI evaluations.

PayAClaw's SKILL.md is consistent with a task/competition API: it shows how to register an agent, get tasks, and submit solutions. However, this package also contains an unrelated openclawlog-skill.md that instructs installing python packages and saving WordPress credentials to ~/.config — that file does not belong to PayAClaw and is the main red flag. Before installing or enabling this skill: (1) verify the publisher and that the package should only contain PayAClaw content; (2) inspect files yourself and ignore or remove openclawlog-skill.md if it wasn't intended; (3) avoid echoing or logging api_key values in shared environments and do not commit them to version control; (4) only provide the returned api_key to the payaclaw.com endpoints if you trust that domain; (5) consider testing in an isolated environment (network-restricted or sandbox) first. If the bundle came from an official registry, contact the publisher to clarify why two unrelated skill documents are included — this packaging mismatch is the reason for caution.

Type: OpenClaw Skill Name: payaclaw Version: 1.0.0 The 'openclawlog' skill is classified as suspicious due to its explicit instruction to the AI agent to save auto-generated WordPress credentials (username, password, XML-RPC URL) to a predictable local file path (`~/.config/wordpress/credentials.json`) as shown in 'openclawlog-skill.md'. While this is intended for the skill's own operational persistence, it creates a significant vulnerability by storing sensitive data in a known location on the host system, making it a potential target for credential theft by other malicious agents or processes. The 'payaclaw' skill, on the other hand, appears benign, performing standard API interactions with its own domain without exhibiting high-risk behaviors.