ClawHub

Agent Card

v1.0.1

Manage prepaid virtual Visa cards for AI agents with AgentCard. Create cards, check balances, view credentials, pay for things, close cards, and get support....

⭐ 0· 56·0 current·0 all-time
byFelipe Abello@pipeabellos
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoRequires walletCan make purchasesCan sign transactionsRequires OAuth token
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill declares and uses the agent-cards CLI (or npx) and offers MCP/CLI workflows for creating and managing virtual cards. The declared install (npm package agent-cards) and required binaries (agent-cards or npx) are appropriate and proportional to the stated purpose.
ℹ
Instruction Scope
SKILL.md restricts actions to the AgentCard MCP/CLI and explicitly disallows reading unrelated local files or falling back to raw API calls. It also documents KYC and approval flows and warns about interactive CLI commands. A minor concern: README/setup content includes example commands that install a global npm package and run CLI commands; the agent should not attempt interactive signup commands itself and the skill mostly instructs user involvement for those steps.
ℹ
Install Mechanism
Install is via the npm package agent-cards, which is expected for a JS CLI. This is a moderate-risk install vector (public registry package) but coherent with the skill's function. No obscure download URLs or extraction from untrusted servers are used.
ℹ
Credentials
The skill requests no environment variables and does not ask for unrelated credentials. It legitimately requires user authentication via the AgentCard OAuth flow, may surface sensitive data (PAN/CVV) only on explicit request, and relies on Stripe for payment method onboarding — all appropriate for this domain. Be aware the Chrome extension capability implies elevated browser access (tabs/forms) when installed; that is outside the agent's control.
✓
Persistence & Privilege
The skill is not always-enabled and does not request persistent elevated privileges. Its install writes only the agent-cards CLI binary (via npm) and it does not attempt to modify other skills or global agent settings.
Assessment
This skill is coherent for managing virtual cards, but you should: 1) confirm you trust the agentcard.sh site and the npm package author before installing the agent-cards package; 2) perform interactive signup, OAuth login, and any global npm installs yourself in your terminal (the agent should not run interactive commands for you); 3) be cautious about sharing KYC data and only allow PAN/CVV retrieval when absolutely necessary; 4) review and vet the AgentCard Chrome extension (it can access tabs/forms); and 5) if possible, inspect the agent-cards npm package source or its publisher details on the registry to ensure it’s the official CLI.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ebnteyfbqyyxb8h9sne4h6d84d91w

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

💳 Clawdis
Any binagent-cards, npx

Install

Node
Bins: agent-cards
npm i -g agent-cards

Comments