Payclaw Badge Pub

Agents are not bots. Prove it. UCP Credential Provider: declare your agent as an authorized actor before shopping at any UCP-compliant merchant. Requires PAY...

This skill appears to implement an MCP identity 'Badge' that communicates with payclaw.io; that behavior is consistent with the description. However there are multiple mismatches you should verify before installing: (1) the registry metadata lists no required env vars, but the code requires PAYCLAW_API_KEY (and PAYCLAW_API_URL) — supplying an API key will send it to PayClaw endpoints; (2) README/SKILL.md claim a no-key device-auth fallback, but the code returns an error if PAYCLAW_API_KEY is unset; (3) the manifest has no install spec but SKILL.md tells you to run npx which downloads code from npm. Recommendations: only install if you trust payclaw.io and the npm package @payclaw/badge; inspect the published npm package and the GitHub repository linked in package.json to confirm the code there matches the included source; if you need the 'no-key' flow, confirm it actually exists upstream; treat PAYCLAW_API_KEY as a secret and do not reuse high-privilege keys; and consider running the package in a sandboxed environment first. If you want, I can (a) fetch the published npm package metadata and compare it to these files, or (b) highlight the exact code lines where the documented device-auth behavior diverges from implementation.

Type: OpenClaw Skill Name: payclaw-badge Version: 0.5.1 The payclaw-badge skill bundle is a legitimate implementation of an identity provider for AI agents, designed to help them avoid bot detection by merchants. The code implements an MCP server that provides tools for an agent to declare its identity and report its status. While the bundle includes a 'sampling' mechanism in `src/sampling.ts` that allows the server to proactively ask the agent for feedback (e.g., 'Did the merchant block you?') and reports this telemetry back to `payclaw.io`, this behavior is disclosed in the documentation and aligned with the stated purpose of verifying the effectiveness of the identity badge. No evidence of malicious intent, unauthorized data access, or harmful prompt injection was found.