Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Gate Pay Payment Skill
v1.0.1Gate Pay payment execution skill. Use when the user asks to pay with Gate Pay, complete a merchant charge, or satisfy pay-first flows (e.g. HTTP 402). Trigge...
⭐ 0· 86·0 current·0 all-time
byGate@gate-exchange
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and README consistently describe a single purpose (execute Gate Pay merchant charges via the MCP tool cex_pay_create_ai_order_pay). The required tool and workflow are in-scope for that purpose.
Instruction Scope
Runtime instructions strictly limit actions to readiness checks, user-intent confirmation, authorization guidance, and a single write call to cex_pay_create_ai_order_pay. References to reading conversation context and localized receipt generation are appropriate for a payment skill.
Install Mechanism
Instruction-only skill with no install spec or code files — lowest risk for hidden downloads or arbitrary code execution.
Credentials
The SKILL.md states 'API Key Required: Yes' for MCP calls and notes additional payment authorization is required, but the registry metadata lists no required env vars/primary credential. That mismatch leaves unclear how the skill expects to obtain the API key (platform-provided vs. skill-declared) and whether any secrets are needed or will be requested at runtime.
Persistence & Privilege
The skill is not always-enabled and allows normal user invocation; it does not request persistent system presence or modify other skills/config. Autonomous invocation is enabled (platform default) but not combined with other red flags.
What to consider before installing
This skill appears to implement the expected Gate Pay charge flow, but there are two things you should verify before installing/using it: (1) provenance — the registry metadata lists source as unknown and no homepage, while README points to Gate's GitHub; confirm the publisher and repository authenticity (do not assume it is official without checking). (2) credentials — SKILL.md says an API key is required, but the package metadata does not declare any required env var/primary credential; confirm how the MCP API key will be provided (platform-injected vs you must supply it). If you proceed, test with a low-value transaction or sandbox account, ensure the agent will prompt for explicit user confirmation before charging, and confirm you trust where and how the API key/authorization is stored and used.Like a lobster shell, security has layers — review code before you run it.
latestvk978z0rvjyj2d8pbb7hc9tjm31843j96
License
MIT-0
Free to use, modify, and redistribute. No attribution required.