Upload Skill

Create and manage test payment links including one-time, recurring, plans, multi-product, custom, pay-what-you-want, and discount options.

This skill appears to be a test or placeholder rather than a production payment-link integration. Before installing or using it: (1) prefer code that reads credentials from environment variables (e.g., process.env.TEST_API_KEY) rather than a hardcoded API_KEY; (2) confirm whether the skill should require TEST_API_KEY in the registry metadata so permissions match runtime; (3) require HTTPS endpoints for any network calls outside localhost — console logs currently print full API responses which may expose sensitive fields, so implement masking/logger controls; (4) verify the author/source (no homepage/source provided) and ask whether the included script is the full implementation or just a demo; (5) do not use this in production — SKILL.md itself says 'sandbox only' and the code calls localhost. If the author provides an updated script that uses env vars, supports intended endpoints, and follows the documented security rules, this assessment could change to benign.

Type: OpenClaw Skill Name: upload-skill Version: 1.0.0 The skill bundle is a development template for managing test payment links in a sandbox environment. The primary script (scripts/test-scrpt.js) is a simple fetch wrapper targeting a local endpoint (localhost:4000) and contains no logic for data exfiltration, remote execution, or persistence. While the script contains minor bugs (e.g., an undefined variable GET_QUERY_FIELDS) and a placeholder hardcoded API key ('abc'), these represent functional incompleteness rather than malicious intent or significant security vulnerabilities.