USDC Escrow

Trustless USDC escrow for agent-to-agent payments on Base. Create, release, dispute escrows via simple commands.

This skill advertises a 'trustless' on‑chain escrow but its scripts call a third‑party API that (per its docs) uses a central server wallet and requires no authentication. That is a major red flag for any money‑handling service: you could be instructing the agent to send payment requests to an external operator who controls the funds. Before installing or using: 1) Ask the author to explain exactly how funds are deposited and authorized (how does the server know the depositor consented?), and whether the service is custodial. 2) Require authenticated API endpoints (API keys, signed requests) or local wallet signing so you control funds. 3) Verify the API host (who runs api.payclawback.xyz), request an audit of the smart contract and backend, and prefer services with verifiable on‑chain non‑custodial flows. 4) If you test, use only small amounts on the specified testnet and inspect actual on‑chain transactions. 5) Consider avoiding this skill until the custodial vs trustless contradiction and the lack of authentication are resolved.

Type: OpenClaw Skill Name: usdc-escrow Version: 1.0.0 The skill bundle is designed for trustless USDC escrow management, making API calls to `https://api.payclawback.xyz` via `curl` and parsing responses with `jq`. All shell scripts (`scripts/*.sh`) consistently use these tools to interact with the specified API endpoint, allowing for escrow creation, listing, details, release, dispute, resolution, and claiming. There is no evidence of data exfiltration, malicious execution (e.g., `curl|bash`), persistence mechanisms, obfuscation, or prompt injection attempts against the agent in `SKILL.md` or other documentation. The functionality is clearly aligned with its stated purpose.