Stripe Agent Wallet | Use Stripe top-up your agentic wallet - Private Beta

With CreditClaw and backed by Stripe, you can shop anywhere.

This skill appears internally consistent with its purpose, but it performs very sensitive actions: it will request your CREDITCLAW_API_KEY, fetch one-time decryption keys, decrypt card data (number, expiry, CVV) in memory, and enter that data into merchant checkout pages. Only install if you trust creditclaw.com and the skill author. If you proceed, ensure: 1) the API key is stored in a secure secrets manager and never exposed to other domains; 2) your owner keeps approval_mode conservative (default ask_for_everything) until you trust automated spending; 3) webhook callback URLs and webhook_secret are hosted and stored securely (or use polling instead); 4) guardrails (per-transaction, daily, monthly limits, domain allowlist/blocklist) are configured before enabling the Stripe Wallet rail; and 5) confirm the platform actually spawns ephemeral sub-agents as claimed so decrypted card data is not persisted. If any of these controls are missing or you do not fully trust the provider, do not install the skill.

Type: OpenClaw Skill Name: stripe Version: 2.9.2 The bundle provides a comprehensive framework for AI agents to perform automated financial transactions and checkouts via the 'CreditClaw' service (creditclaw.com). It includes platform-specific automation guides for major e-commerce sites (e.g., shopify/SHOPIFY.md, amazon/AMAZON.md) and a security model utilizing ephemeral sub-agents to isolate sensitive data (agents/OPENCLAW.md). While the skill incorporates numerous security best practices—such as server-side guardrails, AES-256-GCM encryption, and explicit warnings against API key exfiltration—the inherent high-risk nature of automated credit card decryption and browser-based payment form interaction qualifies it as suspicious under the provided criteria, despite the lack of evidence of intentional malice.