ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Pay For Service

v0.1.0

Access paid API endpoints and content using the x402 payment protocol. Use when you or the user want to call a paid API, access gated content, make an x402 p...

⭐ 0· 220·0 current·0 all-time
byRachid Jarray@rachidjarray-hk-qa-fdt
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The SKILL.md describes paying for x402-enabled endpoints using the Finance District wallet and shows concrete fdx CLI commands (getX402Content, authorizePayment, getWalletOverview). That aligns with the name/description. However, the registry metadata lists no required binaries even though the runtime instructions rely on the local 'fdx' CLI — this is an omission that reduces clarity about what the agent actually needs available.
✓
Instruction Scope
Instructions are narrowly scoped to checking wallet status, wallet balance, and calling fdx to discover payment requirements, authorize, and fetch content. They explicitly instruct confirming with the human before making payments and reference related skills (authenticate, fund-wallet, swap-tokens). The skill does not instruct reading unrelated files, environment variables, or exfiltrating data.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so there is no install-time code being fetched or executed. That minimizes install-time risk.
ℹ
Credentials
The skill requests no environment variables or credentials in metadata. At runtime it will rely on the user's local Finance District wallet/authentication (accessed via the fdx CLI), which is appropriate for its purpose — but the missing declaration of the fdx binary and no explicit mention of the wallet's credential storage means users might not realize the agent will trigger wallet operations that use locally stored keys/funding.
✓
Persistence & Privilege
The skill does not request permanent presence (always:false) and allows model invocation (normal). It does not attempt to modify other skills or system-wide agent settings. Autonomous invocation is permitted (disable-model-invocation:false) which is standard for user-invocable skills.
Assessment
This skill appears to do what it says: run your local Finance District CLI (fdx) to detect x402 payment requirements and pay/fetch gated content. Before installing or using it: (1) ensure you have the fdx CLI installed and understand where your wallet keys/funds are stored (the skill will trigger wallet operations); (2) only use it against endpoints you trust and always confirm payments with a human—the SKILL.md itself advises confirmation for large or unfamiliar charges; (3) consider adding a declared required-binary entry for 'fdx' so the agent/platform can surface availability up front; (4) if you need stronger safety, disable autonomous invocation for this skill or require explicit user confirmation in your agent policy before any payment command is run.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c5yhjpke7mydddkbyk4a67n82kfs9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments