payrail402

Cross-rail spend tracking for AI agents — Visa IC, Mastercard Agent Pay, Stripe ACP, x402, and ACH in one dashboard.

This skill appears coherent and limited to reporting agent transactions to the PayRail402 API. Before installing: 1) Verify you trust the service endpoint (the code defaults to a railway.app host while README refers to payrail402.com); confirm the TLS certificate and operator. 2) Use the least-privilege credentials: prefer a per-agent webhook token for single agents, and create scoped API keys for multi-agent setups. 3) Avoid sending sensitive payment data (full card numbers, unmasked PII) in the description or metadata — only send the minimal transaction fields required. 4) Rotate keys/tokens regularly and limit webhook token reuse across agents. 5) If you need stronger assurance, contact the operator or verify the npm SDK / homepage references exist (the README references an npm package and docs) and audit the remote API behavior on a test account before giving production tokens.

Type: OpenClaw Skill Name: payrail402 Version: 1.0.2 The skill's purpose is to track AI agent financial transactions, and its implementation aligns with this stated goal. The `openclaw-skill.js` code uses standard web requests to a single, specified HTTPS endpoint (`payrail402-production-2a69.up.railway.app`). It explicitly avoids filesystem access, shell commands, and external dependencies, which is verifiable in the code. Credentials are handled securely via HTTP headers or URL path segments over HTTPS. The documentation (`SKILL.md`, `README.md`) is purely informational and contains no prompt injection attempts or instructions for malicious behavior. While the `baseUrl` is configurable, allowing a potential misconfiguration vulnerability, the skill itself does not exhibit any malicious intent or actions.