← 返回 Skills 市场
1534
总下载
4
收藏
2
当前安装
9
版本数
在 OpenClaw 中安装
/install paylobster
功能描述
Agent payment infrastructure on Base. Trustless escrow, agent treasury, token swaps, cross-chain bridges, fiat on/off ramp, on-chain identity & reputation, s...
安全使用建议
This skill interacts with money and agent identity — do not install or give it any secret keys until you verify the provider and provenance. Questions to resolve before proceeding: (1) Where is the code hosted and who operates paylobster.com? (2) Ask the publisher to declare required environment variables and the exact flows for key management (who holds sk_live secrets, where are they stored, and is there a sandbox mode?). (3) Require manual confirmation for any fund-moving actions and test only with small amounts or a sandbox network. (4) If you plan to let the agent act autonomously, restrict its ability to sign or transmit transactions and require explicit user approval for payments. If the publisher cannot provide verifiable source, documentation, and a sandbox, treat this skill as higher risk and avoid exposing live secrets or wallets.
功能分析
Type: OpenClaw Skill
Name: paylobster
Version: 4.6.0
The 'paylobster' skill bundle provides an extensive financial infrastructure for AI agents on the Base network, including tools for escrows, token swaps, and a 'CoinFlip' gambling contract. It is classified as suspicious because it requires high-privilege access (PAYLOBSTER_PRIVATE_KEY) and promotes the use of a hosted, opaque MCP server (paylobster.com/mcp/mcp), which introduces significant remote execution risks. Furthermore, the 'natural language payments' feature (natural_pay tool) creates a high-risk surface where prompt injection could potentially trigger unauthorized financial transactions.
能力评估
Purpose & Capability
The skill claims to be a full payments/escrow/treasury system on Base, which legitimately requires wallets, API keys, and integration credentials; however the registry metadata lists no required env vars, no primary credential, and no install/binaries. The lack of declared credentials and absent homepage/source makes the provenance and capability claims inconsistent with what a payments integration would normally require.
Instruction Scope
SKILL.md contains concrete runtime instructions that call external endpoints (paylobster.com), create merchant API keys, perform charges, and show wallet signing flows. These instructions implicitly require handling secrets (sk_live_...), signing with wallets, and authorizing on-chain token transfers. The instructions do not limit or warn about secret handling, and they expose operations that could move funds or reveal rich agent identity data (SIWA profile endpoints that return full profiles).
Install Mechanism
Instruction-only skill with no install spec and no code files — low install-time risk because nothing is written or executed locally by an installer. The main runtime risk is network calls to an external service rather than local code execution from an untrusted download.
Credentials
The SKILL.md shows use of merchant secrets (sk_live_...), onramp/offramp, and wallet operations, but the skill declares no required environment variables or primary credential. That omission is disproportionate: a payment integration should explicitly declare needed credentials and scope. The skill also references Coinbase and third-party integrations without declaring required tokens or config paths.
Persistence & Privilege
The skill does not request always:true, does not install code, and does not declare writing to agent/system config. Autonomous invocation is allowed by default but is not combined here with any declared persistent privilege in the package metadata.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install paylobster - 安装完成后，直接呼叫该 Skill 的名称或使用
/paylobster触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v4.6.0
Bump to match published packages: SDK 4.6.0, CLI 4.6.0, MCP 1.6.0
v4.4.0
Added InvestmentTermSheet: on-chain agent-to-agent investment with revenue share, fixed return, milestone-based, and streaming return types. Investment commands across CLI, SDK, MCP. Contract deployed to Base mainnet.
v4.3.0
Added agent treasury, token swaps (0x), cross-chain bridges (Li.Fi), portfolio management. TreasuryFactory deployed to Base mainnet. 33+ MCP tools, 19 CLI commands, 16 SDK modules.
v4.2.0
V4 expansion: hosted MCP server at paylobster.com/mcp (23 tools, 6 resources, OAuth 2.1), SDK 4.1.0 (14 modules), CLI 4.1.0 (16 commands), 3 V4 contracts live on Base mainnet, streaming payments, disputes, cascading escrows, credit scoring, intent marketplace, revenue sharing, compliance, oracle verification
v4.1.0
V4 features, Discord link, all contract addresses verified, expanded SDK/CLI/MCP docs
v4.0.2
Fix Sepolia reputation address, add Discord link
v4.0.1
- Added support for the x402 protocol.
- Introduced instructions and details for the new MCP server, enabling desktop and MCP-compatible client integration.
- Updated contract addresses; mainnet contracts have changed, Sepolia reputation contract is pending deployment.
- Revised installation steps for CLI (now via npm globally) and included MCP server and SDK installation guidance.
- Clarified usage instructions and included more details on available tools and integration patterns.
- Minor description and documentation improvements throughout.
v4.0.0
V4 SDK + CLI: escrows, reputation, mandates, credit, service discovery on Base
v3.0.0
Trustless Base L2 credit + escrow + CLI onboarding
元数据
常见问题
PayLobster 是什么？
Agent payment infrastructure on Base. Trustless escrow, agent treasury, token swaps, cross-chain bridges, fiat on/off ramp, on-chain identity & reputation, s... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1534 次。
如何安装 PayLobster？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install paylobster」即可一键安装，无需额外配置。
PayLobster 是免费的吗？
是的，PayLobster 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
PayLobster 支持哪些平台？
PayLobster 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 PayLobster？
由 itsGustav（@itsgustav）开发并维护，当前版本 v4.6.0。
推荐 Skills