Stripemeter

Integrate Stripe usage-based billing with idempotent event ingestion, late-event handling, and pre-invoice reconciliation. Use when implementing usage meteri...

Consider this suspicious because the docs ask you to run third-party code and supply sensitive credentials but the skill metadata lists no required secrets. Before installing or following the Quick Start: (1) review the GitHub repository contents and commit history yourself; (2) do not use live STRIPE_SECRET_KEY — use test keys or the described shadow mode and verify what the code does with keys; (3) run the project in an isolated environment (throwaway VM or container) with a least-privilege DB user and ephemeral Stripe test account; (4) inspect .env.example and code that reads env vars to confirm only expected data is used; (5) prefer running a security review or automated SBOM if you need to run this in production. If the publisher updates the registry metadata to explicitly declare required env vars and confirms the canonical repository and release artifacts (signed releases or official org repo), that would reduce the concern.

Type: OpenClaw Skill Name: stripemeter Version: 0.1.0 The OpenClaw AgentSkills skill bundle for 'stripemeter' is classified as benign. The content, including `SKILL.md` and other documentation, describes a legitimate Stripe usage metering system. All commands and instructions are standard for setting up, running, and troubleshooting a local development environment (e.g., `git clone`, `docker compose up`, `pnpm build`, `curl http://localhost:3000`). There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized remote control, persistence mechanisms, or prompt injection attempts designed to subvert an AI agent's purpose. Sensitive environment variables (like `STRIPE_SECRET_KEY`) are mentioned as necessary configuration for the system, not as targets for exfiltration.