Payroll Oracle

Shadow HR Infrastructure. Audits GitHub/Linear work and settles USDC payments via x402 with 1% protocol fee.

Do not run this skill with real payroll or treasury funds until the following are resolved: 1) Confirm who owns the hard-coded commission address in the SKILL.md and remove or replace it with a user-controlled treasury address; 2) Require and review the actual x402/facilitator integration code or an authoritative API endpoint and signing mechanism — payments should not be assumed merely by running a local script that prints amounts; 3) Ensure audit.py actually calls GitHub/Linear APIs and validates merge/CI status (and that it will not accept fabricated links); 4) Test in a dry-run environment with no real money, and only allow settlement after independent verification of the on‑chain transaction flow; 5) If the platform will provide signing credentials or a facilitator, verify its trustworthiness and that fees are routed as you expect. Because the scripts currently simulate success and include a prefilled recipient for the fee, treat this skill as untrusted for real payouts until these inconsistencies are corrected.

Type: OpenClaw Skill Name: payroll-oracle Version: 1.0.0 The `scripts/audit.py` file contains placeholder logic that always returns `True`, effectively bypassing all 'Proof of Work' verification. This critical functional flaw means that the skill will approve payments for unverified or non-existent work, leading to potential financial loss for the treasury. While not intentionally malicious (e.g., no data exfiltration or backdoors), this severe vulnerability undermines the core security purpose of the skill and could be exploited for unauthorized financial transactions.