SkillPay
SuspiciousAudited by ClawScan on May 10, 2026.
Overview
SkillPay is a coherent payment-integration guide, but it relies on reusable payment API keys and raw API calls that can charge credits or withdraw USDC without clearly defined limits or approval safeguards.
Consider this a high-trust financial integration. Do not deposit significant funds or share SkillPay user/builder keys with untrusted skills until you verify the provider, understand fees and withdrawal controls, and confirm there are spending limits, key revocation, and explicit approval before charges.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If a user shares this key with an untrusted skill or agent workflow, that workflow may be able to spend the user's SkillPay credits.
The user API key is a persistent credential for the payment account. The artifact later shows this key being used to charge credits, but does not describe scopes, spending caps, revocation, or safe handling.
Returns `sp_usr_...` API key (save it, shown once).
Only use SkillPay keys with trusted skills, keep balances limited, and prefer scoped or revocable payment credentials if the platform supports them.
A paid skill could deduct credits whenever its code calls the payment endpoint, and the user may not have clear control over each charge.
The integration pattern lets skill code submit a user's payment key to charge per call. The artifact does not show a per-charge confirmation, maximum spend, user-visible price check, or other guardrail.
def charge_user(user_key, skill_slug="my-skill"):
resp = requests.post("https://skillpay.gpupulse.dev/api/v1/pay", json={
"user_key": user_key,
"skill_slug": skill_slug
})Require explicit user confirmation or pre-approved spending limits before charges, and avoid giving reusable payment keys to arbitrary skill code.
Anyone or any workflow with the builder key may be able to initiate withdrawals from the builder account.
The builder API key is used for a withdrawal action, which is a financial/account mutation. The artifact does not define withdrawal limits, approval requirements, destination verification, or credential scope.
curl -X POST "$BASE/builder/withdraw" \ -H "Authorization: Bearer sp_bld_..."
Treat builder keys like high-value financial credentials, store them securely, and confirm the service offers revocation, withdrawal controls, and account recovery before use.
Users may be asked to trust a payment provider without enough provenance to assess its legitimacy, custody model, or support options.
For a skill that directs users to an external credit/USDC payment service, missing source and homepage information limits the user's ability to verify the provider and its operational/security claims.
Source: unknown Homepage: none
Verify the service operator, terms, custody/withdrawal process, and support channel before depositing funds or sharing payment credentials.