Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
MagicPay
v0.1.0Create payment intents and request stored secrets through MagicPay. Use when an OpenClaw agent needs the live MagicPay HTTP API for payment, subscription, ca...
⭐ 0· 62·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly documents payment intents and stored-secret flows and the curl examples match that purpose. However, the documented base URL is a specific Supabase project (durcottggsiesxxqzvbb.supabase.co) rather than an obvious 'MagicPay' domain, and no homepage or repository is provided. Overall capability matches the stated purpose, but provenance and host naming are unclear.
Instruction Scope
The instructions directly tell the agent to call live HTTP endpoints, create intents, confirm OTPs, and read one-time secret values. The SKILL.md repeatedly references environment variables (AGENTPAY_API_KEY and AGENTPAY_API_URL) and sensitive secret retrieval, but the package metadata did not declare any required env vars or primary credential. The instructions do not direct reading other system files, but they do instruct actions that return raw secrets — so the agent will handle highly sensitive data if given access.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk and no external packages are fetched during install. That minimizes installation risk.
Credentials
The skill requires an API key (AGENTPAY_API_KEY) in practice to perform any meaningful operation — including retrieval of stored secrets — but the registry metadata lists no required env vars or primary credential. Requesting a key that can fetch one-time secrets is high privilege; the skill should have declared this and documented the exact scopes required (agent-scoped vs user-scoped). The default base URL points to an opaque Supabase project which raises provenance and trust concerns for sensitive data flows.
Persistence & Privilege
Flags show the skill is not 'always' enabled and allows normal autonomous invocation. There is no install step that writes configuration or modifies other skills. No elevated persistence or system-wide changes are requested.
What to consider before installing
This skill will call a live API and — if given an API key — can request one-time secret values (sensitive). Before installing: (1) confirm the API host and operator (why does the base URL point to a Supabase project rather than a known MagicPay domain?), (2) require the skill author to declare AGENTPAY_API_KEY (and AGENTPAY_API_URL) in metadata and to state the minimum scopes the key needs (use an agent-scoped, least-privilege key), (3) verify you trust the owner because the skill can read stored secrets, (4) test in a sandbox with a restricted test key that cannot access production secrets, and (5) ensure agent behavior will not log or leak raw secret values. If the author cannot provide provenance or proper declared env vars/scopes, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
http-apivk972j9gjpd9w2cja5nbv51gk8183m98nlatestvk972j9gjpd9w2cja5nbv51gk8183m98nmagicpayvk972j9gjpd9w2cja5nbv51gk8183m98npaymentsvk972j9gjpd9w2cja5nbv51gk8183m98nsecretsvk972j9gjpd9w2cja5nbv51gk8183m98n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.