Security audit
Security checks for vulnerabilities and agentic risk
The skill uses a disclosed fee-comparison service and shares relevant payment details without requesting access to move money.
PaidRouter receives the payment details you submit. Use approximate amounts for confidential activity, protect the retained key, and check source dates before relying on results. Public publisher and privacy information could not be independently verified.
The supplied code performs only a key-related POST request; it does not retrieve fees, cite dated sources, compare providers, or calculate payment costs. Although API-key provisioning could support a broader implementation, the supplied chunk establishes no such connection. No local data or existing credentials are visibly transmitted.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Run once and keep the key (no email needed):
curl -s -X POST https://paidrouter.com/api/keys -H 'content-type: application/json' \
-d '{"use":"openclaw skill"}'
When populated with actual owner data, the request sends payment amounts, payment frequency, and the current payment provider to a third party under a persistent API key. These details can reveal nonpublic business activity, but the workflow provides no explicit privacy notice or approval step before transmission. This is a limited privacy weakness rather than evidence of malicious exfiltration: the fields are relevant to the advertised comparison service, and no payment credentials or customer identities are requested.