VISA Virtual Cards | Manage compatible cards, wallets & payments

This skill appears to be what it says: a CreditClaw payment/virtual-card integration that needs only CREDITCLAW_API_KEY. Before installing or enabling it for an autonomous agent, consider the following: - Treat CREDITCLAW_API_KEY like a sensitive secret and do not expose it anywhere else; follow the skill's warning. Rotate the key if you suspect leakage. - The agent will retrieve one-time decryption keys and decrypt card details in memory. Ensure your agent runtime can hold secrets securely and will not log or persist decrypted card data (PCI considerations). - By default the service uses approval_mode: ask_for_everything, but owners can change settings. If you plan to allow autonomous spending, require strict per-transaction and daily limits, domain allowlists, and require approval above small thresholds. - Test in sandbox / staging first (the docs reference sandbox/test flows) and monitor webhook logs, transaction history, and owner notifications. Restrict agent network access if you want to limit where it can send sensitive data. - If you need higher assurance, ask the skill publisher for an independent security / PCI attestation and confirm the real production domain and published API docs match these files.