PayGents

Accept crypto payments in AI agent conversations. Generate MetaMask/Trust Wallet deeplinks, verify transactions on-chain, check balances, issue receipts. No...

This skill appears to do what it says: build mobile wallet deeplinks, query public RPCs to verify transactions, and produce receipts — and it does not request private keys or API keys. Before installing or enabling it: 1) Be aware public RPC endpoints (default fallbacks) will see wallet addresses and tx hashes; set RPC_<chainId> env vars or a local config.json to point to a private node if you want more privacy. 2) The skill can write receipts to disk (if you use --out) and the instructions recommend persisting a wallet preference — decide whether you want that stored in agent memory or cleared between sessions. 3) The rpc-config code looks for config.json in the skill root and the current working directory — ensure you review any config.json it might pick up to avoid unintended data exposure. 4) Test on a testnet (Sepolia / Base Sepolia) before using mainnet, and verify the skill's origin (the manifest's source is unknown; README references a GitHub repo). 5) No API keys are required, and you should never type or paste private keys into prompts; the workflow intentionally relies on the user's wallet app to approve transactions. If you need stronger privacy, point RPC_* to a node you control and avoid enabling long-term persistence of wallet preferences or receipts.

Type: OpenClaw Skill Name: paygents Version: 0.3.0 The skill bundle implements legitimate cryptocurrency payment functionalities for an AI agent. However, the `scripts/evm-receipt.sh` script contains a path traversal vulnerability via the `--out` parameter. An attacker could craft a prompt to the agent to use this parameter with a path traversal payload (e.g., `../../../../tmp`) to write receipt files to arbitrary locations on the filesystem where the agent has write permissions. While this is a significant vulnerability, there is no clear evidence of intentional malicious behavior (e.g., writing to sensitive system files with malicious content or exfiltrating data) within the skill's code or instructions, classifying it as suspicious rather than malicious.