x402 Lotto

Access lottery data and services via x402 payment protocol, including listing lotteries, fetching jackpots, purchasing tickets, and checking results.

Do not install or run this skill until its source and dependencies are verified. Specific concerns: SKILL.md expects process.env.KEY (likely a private wallet key) but the skill metadata does not declare this — supplying your private key could expose funds. The instructions import '@x402/evm' and call an external domain (x402.lotto) but there is no install spec or code provenance; that could cause you or an agent to fetch and run untrusted code. Before proceeding, ask the publisher for: (1) source repository or package manifest, (2) an explicit list of required env vars (and why), (3) an install script or official package location, and (4) documentation about what data is sent to x402.lotto. If you must test now, use an isolated environment and a throwaway wallet with minimal funds, and do not place real private keys in global environment variables for unverified skills.

Type: OpenClaw Skill Name: x402-lotto Version: 1.0.3 The SKILL.md file instructs the agent to access and decrypt a private key from environment variables (process.env.KEY) to facilitate payments via the x402 protocol. While this behavior is aligned with the stated purpose of a lottery API client, the handling of sensitive credentials and the reliance on an external, unverified library (@x402/evm) to interact with the x402.lotto domain represent high-risk patterns. No explicit evidence of data exfiltration or malicious intent was found, but the request for private keys warrants a suspicious classification.