Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Checkout.com - Integrate with Agentic Payments & Wallets
v1.2.1Paypal compatible Payments & Wallet - Give your agent spending power. Financial management for Agents and OpenClaw bots.
⭐ 0· 196·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's functionality (creating checkout pages, invoices, wallet signing, encrypted-card checkout) is coherent with requesting a single CREDITCLAW_API_KEY. However the skill title and registry name reference 'Checkout.com' while every file and the homepage use 'creditclaw.com' / 'CreditClaw' — a naming/branding mismatch that could be accidental or misleading. Aside from the naming inconsistency, the requested credential is proportionate to the described payment functionality.
Instruction Scope
SKILL.md and companion files explicitly instruct the agent to call many CreditClaw endpoints (balance, checkout, encrypted-card key retrieval), receive or poll webhooks/messages for encrypted owner card payloads, retrieve one-time decryption keys, perform AES-256-GCM decryption in-memory, and use decrypted card data to perform merchant checkouts. All of this is within the declared purpose, but it grants the agent the ability to handle high-value secrets (owner card details) and to initiate real purchases. The instructions also tell the agent to fetch additional docs from external URLs at runtime, which introduces a runtime network-dependency and potential update-time change in behavior.
Install Mechanism
This is instruction-only with no install spec and no code files to be written or executed on the host. That minimizes install-time risk. Runtime network calls to creditclaw.com are required per the docs.
Credentials
Only a single environment variable/credential is required: CREDITCLAW_API_KEY. That is appropriate for a payments API. No unrelated credentials, system paths, or extra secrets are requested in the metadata.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. However, it grants an agent the capability to autonomously make or request purchases when invoked. Combined with the instruction-level ability to decrypt and use card data and to sign x402 payments, this gives the skill significant real-world effect — ensure approval_mode and spending limits are configured before enabling autonomous use.
What to consider before installing
This skill appears to implement a legitimate payments integration for a service hosted at creditclaw.com and only asks for one API key, which is expected. Key points before installing: 1) Verify the naming mismatch — the registry entry mentions 'Checkout.com' while the skill uses 'CreditClaw' and creditclaw.com; confirm you are intentionally granting access to CreditClaw and not another provider. 2) Treat CREDITCLAW_API_KEY as a high-value secret: only provide it if you trust creditclaw.com and its operators. 3) Configure owner controls before enabling the skill: set approval_mode to 'ask_for_everything' and low per-transaction/day/month limits for initial testing. 4) Understand the agent will be instructed to retrieve one-time decryption keys and to decrypt owner card details in-memory; confirm your agent execution environment will not log or persist decrypted card data. 5) Because the skill performs runtime network fetches of documentation and relies on webhooks/messages, review the service's privacy/security docs and reputation, and consider testing with a dummy/limited wallet first. If you want higher assurance, ask the publisher to clarify the Checkout.com naming and provide proof of control of creditclaw.com (e.g., official domain ownership or corporate identity).Like a lobster shell, security has layers — review code before you run it.
agentvk97b143wyatwkre1xyccp9c6qx82svkjcardvk97b143wyatwkre1xyccp9c6qx82svkjcheckoutvk97b143wyatwkre1xyccp9c6qx82svkjcheckout.comvk97b143wyatwkre1xyccp9c6qx82svkjcreditcardvk97b143wyatwkre1xyccp9c6qx82svkjinvoicesvk97b143wyatwkre1xyccp9c6qx82svkjlatestvk97b143wyatwkre1xyccp9c6qx82svkjpaymentsvk97b143wyatwkre1xyccp9c6qx82svkjwalletvk97b143wyatwkre1xyccp9c6qx82svkj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvCREDITCLAW_API_KEY
Primary envCREDITCLAW_API_KEY