PaySpawn — On-Chain Spending Limits for AI Agents

• Analyzed: May 11, 2026, 4:38 AM
• Findings: 1
• Version: 1.0.3
• Hash: 096d8a142a10f189ef7a455c28d5e0685f8c06f48b7680cfabc0a9199b9a3016
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill bundle 'payspawn' is designed to provide spending controls for AI agents making API payments. The `SKILL.md` file clearly outlines its purpose, installation steps, and usage, emphasizing security features like scoped credentials (not private keys), on-chain enforcement of limits, and revocability. There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized remote execution, persistence mechanisms, or prompt injection attempts against the agent. The skill's core functionality involves network requests and payments, which are high-risk by nature, but the skill is explicitly designed to manage and control these actions securely, aligning with its stated purpose.