x402-cli

Pay for x402 payment-gated HTTP endpoints using USDC stablecoins

This skill appears to do exactly what it claims, but it requires an EVM private key which can be used to spend tokens. Before installing or enabling it: 1) Inspect the GitHub repo (https://github.com/razvanmacovei/x402-cli) and the Homebrew tap to ensure the source is trustworthy. 2) Never use your main wallet private key — create a dedicated low-value wallet for this skill or use a remote/hardware signer if supported. 3) Consider restricting agent autonomy (disable autonomous invocation for this skill) if you don't want the agent to initiate payments without explicit approval. 4) Avoid using --skip-verify in production. 5) If you must store the key in environment variables, ensure the runtime environment is secure and secrets are rotated regularly.

Type: OpenClaw Skill Name: x402-cli Version: 1.0.3 The skill bundle is classified as suspicious due to its core functionality requiring and utilizing an `EVM_PRIVATE_KEY` for cryptocurrency payments, as specified in `SKILL.md` and `clawhub.json`. While this capability is essential for the tool's stated purpose and the documentation explicitly warns users to use a dedicated low-value wallet, the inherent high risk associated with handling private keys by an automated agent warrants a 'suspicious' classification. There is no evidence of malicious intent, such as unauthorized data exfiltration, persistence mechanisms, or prompt injection attempts to subvert the agent's behavior beyond the tool's stated function.