← Back to Skills Marketplace
🔌
payment-402
by
PayNodeLabs
· GitHub ↗
· v1.0.1
· MIT-0
170
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install payment-402
Description
Access protected APIs and digital resources via the x402 "Payment Required" protocol on Base L2. This skill automates cryptographic handshakes and USDC micro...
Usage Guidance
This skill appears to implement the described PayNode x402 flow and uses the PayNode SDK and ethers — that is consistent with its purpose. However: (1) the registry metadata omits the fact that the skill requires a CLIENT_PRIVATE_KEY and Bun even though SKILL.md and the scripts require them; this discrepancy reduces trust and you should ask the publisher to correct the metadata and provide a verifiable source/homepage. (2) The skill requires a private key and will sign and broadcast transactions. Only use a dedicated burner wallet with minimal funds (as the README suggests), and never supply keys for your primary/mainnet wallet. (3) Test thoroughly on the provided sandbox/testnet (Base Sepolia) before any mainnet use. (4) Verify the dependency @paynodelabs/sdk-js is legitimate (check registry/package homepage) to avoid typosquatting. (5) If you need stronger controls, require manual human confirmation for any transaction (do not allow autonomous use) or run the skill in an isolated environment. If you are not comfortable with these risks or the missing provenance, do not install until metadata and source are clarified.
Capability Analysis
Type: OpenClaw Skill
Name: payment-402
Version: 1.0.1
The skill enables automated blockchain transactions and private key handling to resolve HTTP 402 'Payment Required' challenges on the Base L2 network. While the code in scripts/request.ts and scripts/utils.ts appears aligned with the stated purpose and includes safety guardrails (e.g., a 2.0 USDC threshold for human approval and burner wallet policies in SKILL.md), the capability to autonomously sign and broadcast financial transactions is a high-risk behavior. No evidence of intentional malice, such as secret exfiltration or backdoors, was detected in the provided files.
Capability Assessment
Purpose & Capability
The SKILL.md and the included scripts clearly require a CLIENT_PRIVATE_KEY and Bun to operate and use @paynodelabs/sdk-js to perform x402 handshakes and on-chain payments — this is coherent with the skill's described purpose. However, the registry metadata at the top of the record says "Required env vars: none" and "Primary credential: none", which contradicts the explicit required_env_vars and primary_credential declared in SKILL.md and used by the code. The source/homepage is also missing, which reduces provenance.
Instruction Scope
The runtime instructions and scripts stick to the payment flow: checking balances, minting test tokens (sandbox), requesting a protected resource and resolving 402 challenges via PayNode. They do not attempt to read unrelated host files or external secrets. However, the skill explicitly requires a private key and allows signing/broadcasting transactions; SKILL.md warns about thresholds and autonomous usage, but that capability is powerful and must be treated carefully.
Install Mechanism
This package is provided as source with a package.json and SKILL.md that instructs 'bun install'. The registry metadata claimed 'No install spec / instruction-only', which is inconsistent. Installing pulls dependencies from npm-like registries (@paynodelabs/sdk-js, ethers, dotenv) — expected for this function but moderate-risk compared to instruction-only skills. No suspicious download URLs or archive extracts were observed.
Credentials
The only secret requested is CLIENT_PRIVATE_KEY, which is necessary to sign payments and therefore proportionate to the stated purpose. The concern is twofold: (1) the registry metadata omitted this requirement (inconsistency), and (2) the skill requires the user to place a raw private key in a .env file — a sensitive practice. The SKILL.md does advise using a burner wallet and sets a human-approval threshold (>2 USDC), but those are guidance rather than enforced platform controls.
Persistence & Privilege
The skill does not request 'always: true' or elevated platform persistence. It can be invoked autonomously (platform default), which combined with the ability to sign and broadcast transactions increases risk, but autonomy itself is normal and expected for skills. There is no evidence the skill modifies other skills or system-wide settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install payment-402 - After installation, invoke the skill by name or use
/payment-402 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
payment-402 v1.0.1
- Added formalized security section: autonomous agents must seek approval for payments exceeding 2 USDC and verify new merchants before first payment.
- Clarified sandbox-first policy: always test on testnet/sandbox endpoints before using mainnet funds.
- Added required_env_vars, required_binaries, primary_credential, and install fields to SKILL.md for improved compatibility and deployment clarity.
- Updated security guidelines to highlight autonomous blockchain transaction capability and thresholds for human consent.
v1.0.0
- Initial release of the payment-402 skill for automating pay-per-resource billing using the x402 "Payment Required" protocol on Base L2.
- Automates cryptographic handshakes and USDC micro-payments to unlock protected APIs and digital resources.
- Includes pre-execution checks for environment, balances, and wallet readiness with explicit security and burner-wallet usage policies.
- Provides agents with a clear execution workflow, troubleshooting tips, and strict safety rules to prevent fund loss.
- Integrated testing guidance, sandboxing utilities, and links to official documentation and SDK resources.
Metadata
Frequently Asked Questions
What is payment-402?
Access protected APIs and digital resources via the x402 "Payment Required" protocol on Base L2. This skill automates cryptographic handshakes and USDC micro... It is an AI Agent Skill for Claude Code / OpenClaw, with 170 downloads so far.
How do I install payment-402?
Run "/install payment-402" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is payment-402 free?
Yes, payment-402 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does payment-402 support?
payment-402 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created payment-402?
It is built and maintained by PayNodeLabs (@paynodelabs); the current version is v1.0.1.
More Skills