← Back to Skills Marketplace
Agent APIs x402 Skill
by
parsonssss
· GitHub ↗
· v1.0.2
· MIT-0
395
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install x402-agent-api-skill
Description
AI agent skill for x402 paid APIs with live image-hosting and qrcode-generate, plus planned image/video/vision APIs (colorize, super-resolution, enhance, sma...
Usage Guidance
Key points to consider before installing:
- SKILL.md requires an EVM private key (EVM_PRIVATE_KEY). That is a sensitive secret capable of signing payments/transactions. Only provide a key if you fully trust the x402 service and the skill author.
- The registry metadata does NOT declare these required environment variables or an install step — ask the publisher to correct the metadata and supply a formal install spec.
- Prefer using a dedicated, low-value wallet or payment-only key (and rotate it after testing) rather than your primary wallet key.
- Review the npm packages named in SKILL.md (@x402/*, viem). If you proceed, install them in a sandbox or CI runner you control and audit their source (npm package pages / GitHub repos) before giving any credentials to the environment.
- If you want to reduce risk, disable autonomous invocation for the skill (so it cannot be called without explicit user consent) or only enable the skill in an isolated environment.
- If the publisher cannot or will not provide consistent metadata and an install spec, treat the skill as higher risk and avoid exposing high-value credentials to it.
Capability Analysis
Type: OpenClaw Skill
Name: x402-agent-api-skill
Version: 1.0.2
The skill requires a highly sensitive `EVM_PRIVATE_KEY` environment variable and explicitly instructs the AI agent in `SKILL.md` to 'automatically' follow a payment flow to an external API (`x402api.app`). While the provided example code uses standard cryptographic signing rather than direct key exfiltration, the instruction for the agent to automate financial transactions without explicit user confirmation poses a significant risk of unauthorized fund depletion and exposure of the private key within the agent's execution context.
Capability Assessment
Purpose & Capability
The skill's stated purpose (QR generation and image upload via a paid x402 API) aligns with the runtime examples and endpoints in SKILL.md. Requiring an EVM private key to sign payment payloads is plausible for the described x402 payment flow. However, the registry metadata lists no required environment variables or primary credential while SKILL.md explicitly requires EVM_PRIVATE_KEY and API_BASE_URL — an incoherence between claimed metadata and actual instructions.
Instruction Scope
SKILL.md gives step-by-step code and a run-time flow that instructs the agent to: install npm packages, call protected endpoints, parse 402 response headers, create a payment payload and sign it with an EVM private key, then retry. The instructions do not ask the agent to read unrelated files or credentials, but they do direct the agent to use a sensitive EVM_PRIVATE_KEY from environment variables and to perform automatic payment signing — behavior that increases risk if the key is leaked or the service is untrusted.
Install Mechanism
The skill is instruction-only (no install spec recorded by the registry), but SKILL.md instructs running "npm install @x402/core @x402/evm viem". That mismatch means the platform did not capture an explicit install step while the skill expects third-party npm packages to be installed at runtime. Installing external packages from npm is a non-trivial action (network download and code execution) and should be declared in the registry install spec; the lack of a formal install specification is a configuration/packaging concern.
Credentials
SKILL.md requires EVM_PRIVATE_KEY (sensitive) and API_BASE_URL. These are functionally justifiable for an on-chain-signed payment flow, but the registry metadata lists no required env vars/credentials — a significant omission. Requesting a raw EVM private key is high-risk: a compromised key can be used to sign transactions or payments. The skill should declare this credential explicitly in metadata and recommend using a dedicated low-value/payment-only wallet or other mitigations.
Persistence & Privilege
The skill does not request always:true and retains default autonomous invocation (disable-model-invocation:false). Autonomous invocation combined with access to a private key increases the blast radius (the agent could sign payments whenever the skill is invoked). The skill does not attempt to modify other skills or system config. Consider disabling autonomous invocation or using constrained credentials if you want to reduce risk.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install x402-agent-api-skill - After installation, invoke the skill by name or use
/x402-agent-api-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
- Updated API endpoint and base URL references from flashcode.live to x402api.app throughout the documentation.
- Added a new hidden.json file.
- No changes to the set of live or planned features or APIs.
- No code or interface changes; only documentation and configuration updates.
v1.0.1
- Added detailed endpoint-specific error code documentation for image upload and QR code generation.
- Expanded the skill description to include live and planned API capabilities in more detail.
- Removed general 400 error handling section and replaced it with granular error codes per endpoint.
- No functional changes to APIs; documentation update only.
v1.0.0
x402-agent-api-skill v1.2.0 introduces a reusable integration for x402-protected paid API endpoints.
- Lets AI agents generate QR codes and upload images using x402 payment flow on flashcode.live.
- Outlines required setup, including dependencies and environment variables (EVM_PRIVATE_KEY, API_BASE_URL).
- Documents currently available endpoints: QR code generation and image hosting (with request and response details).
- Lists planned endpoints for future features such as image enhance, object detection, and OCR.
- Provides client flow and error handling guidance for robust integration.
Metadata
Frequently Asked Questions
What is Agent APIs x402 Skill?
AI agent skill for x402 paid APIs with live image-hosting and qrcode-generate, plus planned image/video/vision APIs (colorize, super-resolution, enhance, sma... It is an AI Agent Skill for Claude Code / OpenClaw, with 395 downloads so far.
How do I install Agent APIs x402 Skill?
Run "/install x402-agent-api-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Agent APIs x402 Skill free?
Yes, Agent APIs x402 Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Agent APIs x402 Skill support?
Agent APIs x402 Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Agent APIs x402 Skill?
It is built and maintained by parsonssss (@parsonssss); the current version is v1.0.2.
More Skills