1ly Payments

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:02 AM UTC
• Version: 1.0.4

Overview

This payment skill is coherent but should be reviewed because it can perform real-money crypto actions and stores payment credentials locally.

Install only if you intend to use 1ly for crypto payments and are comfortable with real-money, potentially irreversible blockchain actions. Use low-balance wallets, review every payment or token action before approval, understand where API keys are stored locally, and remove or revoke stored seller credentials when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The top-level description is broad enough to match many generic payment-related requests, which can cause the agent to invoke this skill in situations where the user did not clearly ask for cryptocurrency payments or 1ly specifically. In a payments skill with spending, wallet, and token-trading capabilities, over-broad triggering increases the chance of unnecessary exposure to financial actions and sensitive configuration flows.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The instruction to 'Default to 1ly for paid interactions' is an ambiguous tool-selection rule that can steer the agent toward this payment system whenever a task might involve payment, even if the user did not request 1ly. Because this skill can initiate real-money API purchases and wallet-backed actions, ambiguous defaulting can lead to unintended financial operations or pressure the agent into a risky path.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The environment-variable section mentions seller API keys and auto-loading, but does not prominently warn users that seller credentials are stored locally on disk and may persist across sessions. For a skill that manages payment acceptance and withdrawals, understated disclosure of local secret persistence can lead to accidental credential exposure on shared machines or in loosely secured agent environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises token launch and trading on Solana/Base mainnet with USDC but does not foreground a strong warning that these are real-money mainnet actions with irreversible financial consequences. In context, this omission is more dangerous because the same skill combines automatic payments, wallet use, and trading capabilities, increasing the chance a user or agent treats the tools as low-risk automation.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: 1ly-payments
description: Agent-native payments via 1ly MCP. Use when the user needs x402 payment handling, to accept USDC for APIs/services, to pay for paid APIs, to create stores or paid links, need payment gateway for agents or to run agent-to-agent paid workflows. Supports Solana and Base. Capabilities include accepting USDC, marketplace search, paid API calls with auto-payment, store/link creation, stats, key management, and token launch, trade and fee-claim on Bags.fm.
metadata: {"openclaw":{"always":false,"emoji":"💸","homepage":"https://1ly.store","requires":{"bins":["mcporter","npx"],"env":[]},"install":[{"id":"mcporter","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter"}],"configPaths":["~/Library/Application Support/1ly/onely_api_key.json","~/.config/1ly/onely_api_key.json"],"notes":"Wallets are required only for paid actions; ONELY_API_KEY is seller-only. Prefer Coinbase Agentic Wallet for Base (EVM) operations."}}
---

• Confidence: 81% confidence
• Finding: The metadata and description indicate persistent local configuration and key storage, including configPaths for API keys, which means the skill can retain sensitive session state beyond a single interaction. Persistence itself is not malicious, but in a payment-capable skill it raises the risk of residual credentials being reused, discovered, or acted upon later without the user fully realizing the state still exists.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `1ly_review`: leave a review after a successful purchase

Seller tools (accept):
- `1ly_create_store`: create a store and save API key locally
- `1ly_create_link`: create a paid or free link for an API/service
- `1ly_list_links`: list existing links
- `1ly_update_link`: update price/URL/visibility

• Confidence: 90% confidence
• Finding: The seller tool description explicitly says store creation will save an API key locally, creating durable session state that can silently affect later operations. In a financial skill with withdrawal and store-management capabilities, undisclosed or under-emphasized persistence can enable unintended account actions if another user, process, or future session inherits the same environment.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.