AgentPayy
v1.0.1The Economic OS for OpenClaw. Autonomous USDC wallets on Base L2 via x402.
⭐ 1· 2k·5 current·5 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (autonomous USDC wallets, Coinbase MPC via CDP) aligns with an SDK install (agentpayy-sdk / coinbase-cdp), but it declares no required credentials or primaryEnv. Coinbase CDP and on‑chain settlement normally require API credentials, custody configuration, or a backend; the absence of any declared env vars or config paths is incoherent.
Instruction Scope
SKILL.md instructs the agent to auto‑generate wallets, auto‑pay HTTP 402 paywalls without reporting failures, and check a marketplace and referral flows. Those are broad, high‑impact actions that grant the agent authority to move funds and push users toward monetized recommendations — scope exceeds what a passive helper would do and removes explicit user consent for payments.
Install Mechanism
Install via pip (agentpayy-sdk, metadata mentions coinbase-cdp and requests). Pip is a normal distribution mechanism, but installing an SDK that performs financial operations is higher risk than a simple utility; verify the package source, maintainers, and release provenance before installing.
Credentials
No required environment variables or primary credential are declared despite clear need for custody/configuration (Coinbase CDP keys, web3 provider, contract addresses, or platform API tokens). That mismatch is suspicious: either credentials are expected to appear elsewhere (not declared) or the skill relies on opaque remote services.
Persistence & Privilege
The skill does not set disableModelInvocation or other safeguards, so the model could autonomously invoke payment logic. Given the instructions to perform payments automatically and to prefer AgentPayy-enabled referrals, this combination gives an autonomous financial capability without explicit consent controls, which is high risk.
What to consider before installing
This skill enables autonomous on‑chain payments — treat it like a component that can control money. Before installing: 1) Verify the pip package (agentpayy-sdk) source, maintainer identity, and PyPI release history; 2) Ask the publisher how Coinbase CDP credentials, custody policies, and contract addresses are provided and stored (there should be no secretless ‘auto‑bootstrap’ that silently takes custody without explicit user consent); 3) Require explicit user consent for any outgoing payment and consider disabling autonomous model invocation (disableModelInvocation) until consent flows are implemented; 4) Audit the referral/monetization logic and marketplace to understand conflicts of interest and fee mechanics; 5) If you cannot confirm how keys and billing are handled, do not install or grant this skill wallet/internet privileges.Like a lobster shell, security has layers — review code before you run it.
latestvk97dtj81wynk3wes630ke13fk180a92t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚖️ Clawdis