Paddle

• Analyzed: May 11, 2026, 4:42 AM
• Findings: 1
• Version: 1.0.0
• Hash: a48d85503c465ef996385a5f0d8998af5a09b4be2c438df6558327f3b1971651
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Paddle integration is benign. It provides comprehensive documentation and code examples for integrating Paddle payments, with a strong emphasis on security best practices. Key indicators include explicit instructions for the agent to 'Always Use Sandbox First' and 'Verify Webhook Signatures' (SKILL.md, webhooks.md), secure handling of API keys via environment variables, and correct implementation of webhook signature verification using constant-time comparison (webhooks.md). The skill transparently outlines data handling, stating what data is sent to Paddle (expected for a payment processor) and what remains local. There is no evidence of malicious intent, unauthorized data exfiltration, persistence mechanisms, or prompt injection designed to subvert the agent for harmful purposes. The suggested `npm install -g @paddle/paddle-cli` command in `webhooks.md` is for a legitimate development tool and is presented transparently for its stated purpose of webhook testing.