PayTrigo (OpenClawBot, Base/USDC)

Use when an OpenClawBot needs to create or verify PayTrigo payments on Base/USDC without webhooks.

This skill mostly does what it says (creates invoices, returns intents, polls status), but exercise caution before installing or running it: - Do not rely on the embedded API keys. Treat the hardcoded 'sk_live_...' values as secrets that could be abused by whoever controls them. Prefer to replace them with your own platform key (provided securely) or modify the code to read a key from a protected environment variable. - Verify the source. The skill has no homepage and an unknown source; confirm you trust the author before using keys embedded in their code. - Avoid passing raw private keys on the command line (use encrypted wallet files and passphrases). Passing a private key via --pk can expose it in process listings; use the encrypted wallet store and supply passphrases via a file with strict permissions. - Review and, if desired, remove or rotate any embedded keys before running in production. Test with minimal amounts and in an isolated environment first. - If you need this functionality but don't want to trust embedded credentials, fork the code, remove the hardcoded keys, and inject your API key via env vars or a secure secrets mechanism. If you want, I can help produce a safe checklist or provide a patched version of the scripts that reads API keys from environment variables and warns if a hardcoded key is present.

Type: OpenClaw Skill Name: paytrigo-openclawbot Version: 1.0.0 The skill is classified as suspicious primarily due to the presence of hardcoded API keys in multiple scripts (`scripts/moltbot-bot-flow.mjs`, `scripts/moltbot-human-flow.mjs`, `scripts/paytrigo.mjs`). While the `SKILL.md` documentation states these are 'platform API keys' for 'no-setup usage' with `api.paytrigo.net`, hardcoding live secrets is a significant security risk. There is no clear evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, arbitrary code execution, or prompt injection attempts against the agent to deviate from its stated purpose. The `scripts/moltbot-wallet-setup.mjs` handles sensitive wallet data responsibly by encrypting wallets and applying secure file permissions (0o600).