OpenClaw 1ly Payments

• Risk level: Low
• Analyzed: Feb 16, 2026, 5:54 PM
• Findings: 0
• Version: 1.0.4

Overview

The skill's requirements and runtime instructions are coherent with a payments integration: it asks for wallet keys, budget settings, and npm/mcporter tooling needed to install and call 1ly MCP, but there are minor metadata inconsistencies and you should treat the requested wallet credentials as highly sensitive before enabling.

This skill appears coherent for integrating 1ly payments into OpenClaw, but you should: (1) Verify the upstream project (check the listed GitHub and npm pages) before installing or running npx/npm packages; (2) Treat ONELY_WALLET_SOLANA_KEY, ONELY_WALLET_EVM_KEY, and ONELY_API_KEY as highly sensitive — prefer provider-based auth and avoid pasting raw keys into chat or third-party tools; (3) Confirm which env vars are actually required for the features you need (SKILL.md says envs are conditional but registry lists them as required); (4) Consider running installs (npm/mcporter/npx) in a controlled environment (container or sandbox) if you are unsure; (5) If you need higher assurance, ask the publisher for a signed release or more provenance (owner/publish source) because the registry source is marked 'unknown' despite links in SKILL.md.