Payclaw

Agent-to-Agent USDC payments. Create wallets, send/receive payments, escrow between agents. Built for the USDC Hackathon on Moltbook.

This skill is a CLI wrapper around an external 'circle-wallet' tool and expects you to provide a Circle API key (it stores that key in ~/.openclaw/payclaw/config.json). Before installing: (1) verify you trust the author/repository (the registry metadata lacks a homepage but SKILL.md points to a GitHub repo); (2) ensure you intend to install and run the external 'circle-wallet' binary that this code invokes; (3) be aware the CLI constructs shell commands by interpolating user-supplied values into execSync(`circle-wallet ${cmd}`) — inputs are not sanitized, so malicious or malformed addresses/arguments could cause command injection on your machine; (4) note the SKILL.md shows a programmatic import (PayClaw class) that is not present in the provided code — the only delivered artifact is a CLI; (5) if you proceed, consider running it in a restricted environment (container/VM) and inspect or modify the code to sanitize inputs (avoid passing raw user strings into shell commands) and confirm where the Circle key is stored and that it's acceptable to you. If you don't trust the source or cannot verify the external 'circle-wallet' binary, treat this skill as risky.

Type: OpenClaw Skill Name: payclaw Version: 1.0.0 The skill is classified as suspicious due to its reliance on `child_process.execSync` in `src/cli.ts` to execute an external `circle-wallet` CLI tool. While this is plausibly needed for its stated purpose of USDC payments and wallet management, it introduces a significant attack surface. The security of the skill heavily depends on the integrity and security of the `circle-wallet` binary, which is not bundled with the skill. Additionally, the `SKILL.md` installation instructions include `npm link`, which grants broad permissions by creating symlinks in global or local `node_modules`, an action typically reserved for development and not ideal for production installations.