PayTheFlyPro

Create crypto payment & withdrawal links for your app. Works with BSC, Ethereum, TRON. Users pay via PayTheFlyPro gateway - you get shareable URLs with built...

This skill appears to do what it says: generate signed payment and withdrawal links. Before installing or using it, do the following: 1) Only set PTF_SIGNER_KEY for a dedicated signer wallet that holds no funds; never reuse a main wallet key. 2) Run `npm install` in a controlled environment and review package versions (ethers/tronweb) to reduce dependency supply-chain risk. 3) Verify the PayTheFlyPro homepage and the skill owner if you don't already trust the source. 4) Prefer supplying PTF_CUSTOM_RPC that you control (or your own RPC) for queries to avoid leaking serial numbers to third-party RPC providers. 5) Store environment variables securely (avoid exposing them in shared shells or logs). If you want higher assurance, audit the included scripts and try them locally with a throwaway signer key first.

Type: OpenClaw Skill Name: paythefly Version: 1.0.8 The skill is designed to generate signed crypto payment and withdrawal links, a function that inherently requires handling a private key (`PTF_SIGNER_KEY`). The `SKILL.md` documentation explicitly addresses this high-risk operation with a 'Security Notice,' advising users to use a dedicated, unfunded wallet for signing, which demonstrates an awareness of security and a lack of malicious intent. The code in `scripts/payment.mjs`, `scripts/withdrawal.mjs`, and `scripts/query.mjs` uses standard crypto libraries (`ethers`, `tronweb`) to interact with legitimate blockchain RPCs and the `pro.paythefly.com` service, without any evidence of data exfiltration, unauthorized execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent. All operations are aligned with the stated purpose.