AgentXPay

This skill appears to implement the advertised x402 on‑chain payment flow, but it requires you to supply a raw PRIVATE_KEY and allows the agent to call arbitrary external endpoints and sign/submit transactions. Before installing or using it: - Do not provide your primary wallet private key. Instead create a dedicated spending key/account with only the funds you are willing to risk, or use a signer that enforces limits (hardware wallet / remote signer) if possible. - Prefer testing on a testnet RPC and test contract addresses first (skill references testnet examples). Verify transactions and behavior on a disposable account. - Review or vendor‑audit the @agentxpay/sdk (the skill inlines/depends on this SDK) and the included scripts/run-tool.ts to confirm there are no unexpected network callbacks or telemetry endpoints. The package appears to call only the specified chain RPC and target AI service endpoints, but you should verify the SDK source code used in your environment. - Limit agent autonomy: if your agent platform allows it, require explicit user confirmation before any tool call that results in an on‑chain payment or wallet authorization. - Verify contract addresses (SERVICE_REGISTRY_ADDRESS, PAYMENT_MANAGER_ADDRESS, etc.) are correct and controlled by the intended infrastructure; otherwise you may pay a third party. Given the sensitive nature of PRIVATE_KEY and the ability to perform payments automatically, proceed only after the above mitigations. If you want, I can point out specific lines in the code that perform signing/sending or produce a short checklist of how to create a restricted spending key and run the skill in a sandbox/testnet.