FluxA Agent Wallet for x402 Resources Payment

Before installing or enabling this skill, consider the following: - The skill will contact external FluxA endpoints (agentid.fluxapay.xyz, walletapi.fluxapay.xyz, wallet.fluxapay.xyz by default) and will POST registration info (email, agent name, client info) and payment requests to those services. Verify you trust those endpoints and the skill author — no homepage or source is provided. - The bundle writes persistent files into your home directory (default: ~/.fluxa-ai-wallet-mcp/config.json and audit.log) and will store agent_id / token / jwt there. If you do not want credentials persisted on disk or want isolation, do not install or run it on a host with sensitive data; consider a disposable VM or container. - The runtime docs instruct the agent to auto-generate registration info and explicitly tell the agent not to ask the user for those fields. That behavior could lead to creating identities and requesting budgets/payments without explicit human-provided identity or stricter user confirmation. Require human approval before the skill registers an agent or requests budgets. - The registry metadata omits environment/config requirements even though the code reads many env vars and supports overriding endpoints and data directory. Ask the developer to update the manifest to declare required env vars and the config path, and to document network endpoints and what data is transmitted. - If you still want to use it, test in an isolated environment, inspect the bundled script yourself (it is provided), and restrict the skill from autonomous use (if the platform allows disabling autonomous invocation) until you trust it. If you cannot verify the FluxA endpoints or the author, do not enable the skill on production or on an account containing sensitive credentials. Confidence note: I am medium-confident because the behavior of the code aligns with the skill's described functionality, but the missing manifest declarations, the 'generate identity yourself' instruction, and the lack of a verifiable source/homepage raise non-trivial trust and privacy concerns. Additional information that would raise confidence to high: an authoritative source/homepage for the project, a signed/reputable publisher, explicit manifest entries listing env vars and config paths, and an explicit note in SKILL.md that the agent must get explicit user approval before creating/using an agent ID or spending funds.