Mcp Server

Search and buy digital game codes, eShop cards, PSN vouchers from Play-Asia.com via HTTP or MCP. Three purchase methods — Wallet (instant), Lightning (instan...

This skill appears to be what it says: a Play‑Asia MCP server for searching and buying digital codes. Before installing or running it, consider the following: - Only provide PA_TOKEN if you trust the code/run-time location. Give the token the minimum scope you need (use 'info' for read-only; 'purchase' only if you will let the agent spend). Use spending limits when generating the token on Play‑Asia. - The code and docs allow anonymous Lightning/Bitcoin purchases and wallet purchases. Wallet purchases use PA_TOKEN and can spend your balance — treat the token like a password and regenerate it if you ever paste it into chat. - The package includes an npm-based tool (authors expect users may run it via npx). If you plan to run with npx, be aware that npx will fetch from npm; prefer auditing the included source or running the bundled code locally rather than pulling from the network if you don't trust the publisher. - There are minor inconsistencies in the docs/metadata (some files mention requiring the npx bin, some frontmatter says 'discovery-only'). Ask the publisher (or inspect src/) to confirm intended installation/usage and that PA_BASE_URL is not pointed to an unexpected host. - For extra safety, run the MCP server in an isolated environment/container and verify network requests go only to play-asia.com (or your expected PA_BASE_URL). If you only need browsing, you can avoid supplying PA_TOKEN to prevent wallet actions. If you want, I can highlight exactly where in the source the token is read and used, or produce a short checklist for securely generating and using a PA_TOKEN with this skill.

Type: OpenClaw Skill Name: playasia Version: 0.2.1 The bundle is a legitimate MCP server for interacting with the Play-Asia.com API to search for and purchase digital game codes. It includes proactive security instructions in SKILL.md to prevent the AI from leaking sensitive authentication tokens (PA_TOKEN) and provides clear documentation for its Lightning Network (L402) payment flow. The TypeScript implementation in src/ is well-structured, uses standard dependencies, and contains no evidence of malicious intent, data exfiltration, or unauthorized execution.