tron-x402-payment-demo

Demo of x402 payment protocol by fetching a protected image. Triggers: '演示x402-payment' or 'demo x402-payment'

This skill is plausible for a payment demo but contains inconsistencies that you should resolve before installing. Specifically: - Do not provide your main TRON private key. The SKILL.md references TRON_PRIVATE_KEY but the registry did not declare any required env vars — ask the publisher why the key is not declared and what exact operations the skill (and the referenced x402_payment_tron skill) will perform. - Verify the external endpoint (http://x402-tron-demo.sunagent.ai/protected) and the other skill ('x402_payment_tron'). Confirm their ownership, code, and privacy practices so you know where requests/transactions go. - Prefer a throwaway/test key with no funds if you want to try the demo, and monitor what network calls are made. Request that the skill explicitly declare required environment variables and include a clear list of external hosts it will contact. - If you cannot inspect the referenced skill or get clear answers from the author, treat this as higher-risk and avoid supplying any sensitive credentials.

Type: OpenClaw Skill Name: tron-x402-payment-demo Version: 1.0.3 The skill requests access to the highly sensitive `TRON_PRIVATE_KEY` environment variable, which could be used for signing transactions in the stated 'x402 payment demo'. While this capability might be necessary for the demo's purpose of 'signing permits', the direct access to a private key represents a significant security risk. Additionally, the skill delegates core payment logic to an unprovided external skill, `x402_payment_tron`, introducing an unanalyzed dependency and potential supply chain risk. The external network call to `http://x402-tron-demo.sunagent.ai/protected` is also noted.