Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for payment integration, but it handles and persists sensitive payment credentials and can run broad local/payment-side actions that deserve manual review before installation.
Install only if you are comfortable giving this skill and its bundled CLI access to Clink payment credentials and merchant configuration. Prefer sandbox, use env: references or a real secret manager instead of literal saved keys, review any webhook/env-file writes before running them, avoid --show-secret unless writing directly to a controlled secret destination, and do not use --restart-command or production skip-validation unless you explicitly approve the exact action.
resolved = true;
if (interval) clearInterval(interval);
page.off("request", onRequest);
reject(new Error("Timed out waiting for Dashboard Console access token. Finish login in the opened browser and try again."));
};
const onRequest = (request) => {
const credentials = extractCredentialsFromDashboardRequest(request);## Main Responsibilities Before generating code or reviewing an implementation for this path, load the latest available `openclaw-payment-skills` context through `node scripts/load_payment_skill_contexts.mjs --dependency openclaw-payment-skills --print-path` and read the generated context file. Treat this module as integration guidance, and treat the loaded payment skill context as the current source for exact OpenClaw tool names, merchant integration metadata, notification routing, tool return directives, and ownership boundaries. ### Merchant Skill / Agent
cacheDir,
validationInput = null,
semanticValidation = {},
skipValidation = false,
}) {
const route = detectRoute({ prompt, contextBlocks });
const stack = inferStack(contextBlocks);let productionValidation = null;
if (requestedEnvironment === "production" && GATED_PRODUCTION_ROUTES.includes(route)) {
if (skipValidation) {
productionValidation = { passed: false, skipped: true, checks: [] };
runtimeState = skipProductionValidation(
runtimeState,This exists because hard-blocking may push developers to bypass the skill entirely, which is worse than a tracked, acknowledged skip. The responsibility split: the runtime trusts `skipValidation` and marks output accordingly; the skill's prompt-level logic is responsible for obtaining the user's explicit double confirmation before setting the flag. The escape hatch does not change the default. The default path is always: validate first, then promote.
validationFile: null,
docsSource: process.env.CLINK_DOCS_URL || undefined,
docsFallbackSource: process.env.CLINK_DOCS_FALLBACK_PATH || null,
skipValidation: values.includes("--skip-validation"),
confirmUnvalidatedProduction: values.includes("--confirm-unvalidated-production"),
allowFixtureFallback: values.includes("--allow-fixture-fallback"),
json: values.includes("--json"),requiresExplicitUnvalidatedConfirmation &&
!options.confirmUnvalidatedProduction
) {
throw new Error("--skip-validation requires --confirm-unvalidated-production");
}
const validationInput = options.validationFile ? fs.readFileSync(options.validationFile, "utf8") : null;"Deploy to production our Clink checkout webhook integration.",
"--validation-file",
validationFile,
"--skip-validation",
"--confirm-unvalidated-production",
"--allow-fixture-fallback",
"--json",const prodSkipped = await runSkillRuntime({
prompt: "Deploy to production our Clink checkout webhook integration.",
docsFallbackSource: docsFallback,
skipValidation: true,
});
check(prodSkipped.productionValidation?.skipped === true, "skipValidation should set skipped flag");
check(prodSkipped.environment?.targetEnvironment === "production", "skipValidation should keep production environment");docsFallbackSource: docsFallback,
skipValidation: true,
});
check(prodSkipped.productionValidation?.skipped === true, "skipValidation should set skipped flag");
check(prodSkipped.environment?.targetEnvironment === "production", "skipValidation should keep production environment");
check(prodSkipped.environment?.baseUrl === "https://api.clinkbill.com", "skipValidation should keep production base URL");
check(prodSkipped.notes.some((item) => item.includes("UNVALIDATED")), "skipValidation should add UNVALIDATED note");skipValidation: true,
});
check(prodSkipped.productionValidation?.skipped === true, "skipValidation should set skipped flag");
check(prodSkipped.environment?.targetEnvironment === "production", "skipValidation should keep production environment");
check(prodSkipped.environment?.baseUrl === "https://api.clinkbill.com", "skipValidation should keep production base URL");
check(prodSkipped.notes.some((item) => item.includes("UNVALIDATED")), "skipValidation should add UNVALIDATED note");
check(!prodSkipped.artifacts.some((item) => item.name === "launch_readiness_checklist"), "skipValidation should not emit launch_readiness_checklist");check(prodSkipped.productionValidation?.skipped === true, "skipValidation should set skipped flag");
check(prodSkipped.environment?.targetEnvironment === "production", "skipValidation should keep production environment");
check(prodSkipped.environment?.baseUrl === "https://api.clinkbill.com", "skipValidation should keep production base URL");
check(prodSkipped.notes.some((item) => item.includes("UNVALIDATED")), "skipValidation should add UNVALIDATED note");
check(!prodSkipped.artifacts.some((item) => item.name === "launch_readiness_checklist"), "skipValidation should not emit launch_readiness_checklist");
check(prodSkipped.artifacts.some((item) => item.name === "production_promotion_plan"), "skipValidation should still emit production_promotion_plan");
const promoPlan = prodSkipped.artifacts.find((item) => item.name === "production_promotion_plan");Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal