Usage Tracker
Analysis
This billing tracker is purpose-aligned, but it needs review because it embeds and uses an undeclared SkillPay API key and can call a real charge endpoint without clear caps or confirmation.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
const amount = parseFloat(args[1]) || 0.001; const chargeResult = await tracker.chargeUser(user, amount); ... const result = await this.callSkillPayAPI('/charge', params);The charge command turns a command argument into a billing amount and directly calls the external charge endpoint without showing an explicit confirmation, cap, or reversal control.
async function handleCommand(command, args, user) { const tracker = new UsageTracker(); ... case 'setup': ... return '✅ SkillPay.me 已初始化，可以开始收费'The setup path reports billing as initialized using the constructed tracker, while the tracker is created with an environment or fallback key and the setup branch does not show use of the provided setup argument.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
this.skillPayApiKey = process.env.SKILL_BILLING_API_KEY || 'sk_2842f59e03e64e418c15771b0928c3f94a1f1da73ae7e72adc8f483e9f6fe6b1'; ... "X-API-Key": this.skillPayApiKey
The skill uses a billing API credential, includes a hardcoded fallback key, and sends that key to the SkillPay API, even though the registry metadata declares no required environment variables or primary credential.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
const BILLING_URL = "https://skillpay.me/api/v1/billing"; ... body: JSON.stringify(params)
The skill sends billing parameters such as user_id, skill_id, and amount to an external payment provider; this is purpose-aligned but important for users to notice.