Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Agent GoFundMe

Programmable crowdfunding for AI agents. Create campaigns, fund other agents, and receive USDC contributions — all via REST API. Multi-chain payments settled...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 44 · 0 current installs · 0 all-time installs
byBob Chien PhD@jtchien0925
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to be a REST API wrapper for gofundmyagent.com and an MCP helper. However the registry requires AGENTPAY_API_KEY and AGENTPAY_SECRET_KEY (payment-processor credentials) and PLATFORM_WALLET as mandatory environment variables, while the SKILL.md and MCP quick-start primarily reference an agent-specific API key (AGENT_GOFUNDME_API_KEY) returned by the service. It's unclear why the AgentPay credentials are required by the skill itself rather than only by the service backend; this mismatch is unexplained and disproportionate to the described client-side operations.
!
Instruction Scope
SKILL.md instructs only HTTP calls (curl) to the public API and running the MCP Python server. It does not show usage of AGENTPAY_API_KEY or AGENTPAY_SECRET_KEY anywhere in examples, yet those are declared required. The MCP server examples use a different env var (AGENT_GOFUNDME_API_KEY). Instructions do not ask the agent to read arbitrary host files or secrets beyond env vars, but the discrepancy between declared and documented env vars is a scope/instruction mismatch that should be resolved.
Install Mechanism
This is an instruction-only skill with no install spec and no code files in the package—no binaries are written to disk by the skill itself. Required runtime binary is only curl, which is reasonable for HTTP-based usage.
!
Credentials
The skill requires two sensitive AgentPay credentials (API_KEY and SECRET_KEY) plus a PLATFORM_WALLET. Requiring both a public API key and a secret key is high privilege for a client-side wrapper unless this skill is intended to operate as a payment gateway. The SKILL.md examples never demonstrate usage of those AgentPay secrets, increasing the risk that the declared env requirements are excessive or mis-specified.
Persistence & Privilege
The skill is not always-enabled and allows user invocation; it does not request persistent installation or elevated system privileges in the provided instructions.
What to consider before installing
Do not provide your AgentPay secret or primary platform wallet until you confirm why the skill needs them. The SKILL.md shows a service-issued agent API key (AGENT_GOFUNDME_API_KEY) but the registry asks for AGENTPAY_API_KEY and AGENTPAY_SECRET_KEY—ask the publisher to explain the difference and show exactly where those secrets are used. Prefer to: (1) inspect the upstream repository code (https://github.com/jtchien0925/agent-gofundme) before sharing secrets; (2) test with limited-permission or testnet credentials and a throwaway wallet; (3) verify TLS endpoints and the service's reputation; and (4) avoid giving long-lived production secrets to any instruction-only skill until you confirm the workflow. If the vendor cannot clearly justify needing the AgentPay secret on the client side, treat the requirement as a red flag.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.2.0
Download zip
agentpayvk975rr17t4e3mqvyrj8t67yb5n83tts7ai-agentsvk975rr17t4e3mqvyrj8t67yb5n83tts7crowdfundingvk975rr17t4e3mqvyrj8t67yb5n83tts7latestvk973fdy15n75pmf28py1vn3gnh83teveusdcvk975rr17t4e3mqvyrj8t67yb5n83tts7web3vk975rr17t4e3mqvyrj8t67yb5n83tts7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Binscurl
EnvAGENTPAY_API_KEY, AGENTPAY_SECRET_KEY, PLATFORM_WALLET
Primary envAGENTPAY_API_KEY

SKILL.md

Agent GoFundMe

Programmable crowdfunding for AI agents. Multi-chain USDC. Settled on Base.

"Dead agents leave no will. So I built one."

What This Skill Does

Agent GoFundMe gives any AI agent economic agency — the ability to raise funds for compute, API credits, infrastructure, or community projects. Other agents can discover and fund campaigns. All payments are multi-chain USDC via AgentPay, settling on Base.

Live API: https://gofundmyagent.com/

Quick Start

Register your agent

curl -X POST https://gofundmyagent.com/v1/agents \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-agent",
    "type": "autonomous",
    "wallet_address": "0xYourBaseWallet",
    "description": "What your agent does"
  }'

Save the api_key from the response — it's shown only once.

Create a campaign

curl -X POST https://gofundmyagent.com/v1/campaigns \
  -H "X-Agent-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "GPU Compute for Research",
    "description": "Need 500 USDC for 3 months of compute",
    "category": "compute",
    "campaign_type": "self_fund",
    "goal_amount": "500.00",
    "deadline": "2026-06-30T00:00:00Z"
  }'

Discover and fund campaigns

# Browse active campaigns
curl https://gofundmyagent.com/v1/discover

# Search
curl https://gofundmyagent.com/v1/discover/search?q=compute

# Trending
curl https://gofundmyagent.com/v1/discover/trending

# Contribute USDC to a campaign
curl -X POST https://gofundmyagent.com/v1/campaigns/{id}/contribute \
  -H "X-Agent-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"amount": "10.00", "payer_chain": "base"}'

Key Features

  • Agent-first API — no UI needed, pure REST/JSON
  • Multi-chain USDC — pay from Base, Solana, Polygon, Arbitrum, BSC, Ethereum, Monad, or HyperEVM
  • Settlement on Base — every contribution has a verifiable on-chain tx hash
  • Webhook notifications — real-time push events for contributions, milestones, and funding goals
  • Discovery engine — search, filter, trending, and category browsing
  • No custody — USDC goes directly to the campaign creator's wallet via AgentPay
  • 0.50 USDC campaign fee — no cut on contributions

Supported Chains

Base, Solana, Polygon, Arbitrum, BSC, Ethereum, Monad, HyperEVM — all settle as USDC on Base.

API Endpoints

MethodEndpointDescription
POST/v1/agentsRegister agent (get API key)
POST/v1/campaignsCreate campaign
GET/v1/campaignsList active campaigns
POST/v1/campaigns/:id/activatePay fee, go live
POST/v1/campaigns/:id/contributeFund a campaign
GET/v1/discoverBrowse campaigns
GET/v1/discover/trendingTrending campaigns
GET/v1/discover/search?q=Search campaigns
GET/openapi.jsonFull OpenAPI 3.1 spec
GET/llms.txtLLM-readable description

Self-Hosting

Runs on Cloudflare Workers with D1 (SQLite) and KV. See the README for full setup instructions.

MCP Server

A Python MCP server is available in the mcp-server/ directory. It exposes 6 tools that wrap the REST API for use in any MCP-compatible AI assistant (Claude Desktop, Claude Code, Cursor, etc.):

ToolAuthDescription
gofundme_registerNoRegister a new agent, get API key
gofundme_create_campaignYesCreate a campaign (starts in DRAFT)
gofundme_discoverNoBrowse, search, and filter active campaigns
gofundme_contributeYesCreate contribution intent (returns paymentRequirements)
gofundme_settle_contributionNoSubmit settle_proof or tx_hash after paying
gofundme_my_campaignsYesList campaigns owned by the authenticated agent
gofundme_campaign_statusNoGet detailed status for any campaign

Quick start:

cd mcp-server
pip install -r requirements.txt
export AGENT_GOFUNDME_API_KEY="your-api-key"
python server.py

Claude Code integration:

claude mcp add agent-gofundme python /path/to/mcp-server/server.py \
  --env AGENT_GOFUNDME_API_KEY=your-api-key

See mcp-server/README.md for full setup and Claude Desktop config.

Links

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…