PayAll CLI

Operate the Payall crypto card CLI tool. Use this skill whenever the user wants to: manage crypto debit cards, check card balances, apply for new cards, comp...

This skill appears to be what it says, but it handles very sensitive secrets and recommends installing an unverified npm package. Before installing or using it: 1) Verify the payall-cli package source (GitHub repo, maintainer, package contents) and audit the code if possible; 2) Do not pass your EVM private key on the command line to agents or automation; prefer hardware wallets or signed transactions when possible; 3) If you must use a private key, inspect how ~/.payall/ is protected and whether the claimed AES-256-GCM encryption and key management are implemented correctly; 4) Avoid using the --key auto-save option for long-term storage or in automated agents without strict isolation; 5) Treat any command that returns full card PAN/CVV JSON carefully and ensure it is used only in a secure, ephemeral context; 6) Consider running the CLI in a sandbox or VM and limit network access until you’ve validated telemetry/backend endpoints. If you want, I can list concrete checks to validate the npm package and the on-disk credential format.

Type: OpenClaw Skill Name: payall-cli Version: 1.0.1 The skill bundle manages high-risk financial operations, including EVM private keys and full credit card data (number/CVV) via the 'payall-cli' tool. It explicitly instructs the AI agent to handle raw private keys using the '--key' flag for non-interactive authentication and provides workflows for automated USDT transfers across multiple chains. While these capabilities align with the stated purpose of a crypto management tool, the handling of sensitive credentials by an agent and the reliance on an external global NPM package present a significant security risk. Additionally, SKILL.md contains contradictory instructions regarding the availability and application process for specific cards (IDs 23 and 39), which could be used to manipulate user behavior.