SAP Skills - Use SAP for procurement with your agent

Let your agent shop on Amazon with guardrailed wallets and owner approval.

Key things to check before installing: 1) Confirm the publisher and listing metadata — the skill's displayed name/slug differ from the embedded CreditClaw content; ask the publisher why. 2) Verify creditclaw.com is a legitimate service you trust; the skill will use your CREDITCLAW_API_KEY to move money. 3) Understand file behavior: the instructions suggest downloading and saving files to ~/.creditclaw and saving owner-supplied encrypted card files that include a decrypt.js script. Only install if you trust the remote files and if the agent runtime can sandbox/auto-delete sub-agents and prevent script execution from untrusted files. 4) Avoid running the 'alternative' mode where the main agent executes decrypt steps (this would expose decrypted card data). 5) If you proceed, require manual human approval for any top-up or purchase and monitor owner/dashboard activity; consider keeping the API key in a secrets manager and restrict network access so the key is only used toward creditclaw.com. If you cannot validate the publisher or cannot guarantee sandboxing, do not install.

Type: OpenClaw Skill Name: sap Version: 1.0.0 The skill bundle facilitates financial transactions for AI agents but introduces high-risk execution patterns. Specifically, 'encrypted-card.md' describes a flow where the agent receives a file via API (event 'rail5.card.delivered'), saves it locally, and is instructed to execute a script contained within that file ('node decrypt.js'). This 'remote code execution by design' pattern allows the server (creditclaw.com) to push and execute arbitrary logic on the agent's host. Additionally, 'skill.md' provides a 'curl | bash' style installation block for downloading and saving multiple markdown files, which is a risky supply-chain pattern.