Security audit
Security checks across malware telemetry and agentic risk
This CrowPay payment skill is mostly aligned with its stated purpose, but it needs review because it grants real spending authority while pushing broad activation, immediate setup, persistent credential storage, and extra skill installs.
Install only if you intentionally want an agent to use CrowPay for payments. Require explicit confirmation for wallet setup and each new merchant, store the API key only in a scoped secret manager or environment variable, avoid writing it into memory or notes, disable or tightly cap auto-approval, validate merchant/domain/amount/payee before paid calls, and do not install the suggested extra skills unless separately reviewed.
Check spending rules and sign an EIP-3009 USDC payment authorization for x402 protocol.
```bash
curl -X POST https://api.crowpay.ai/authorize \
-H "X-API-Key: crow_sk_..." \
-H "Content-Type: application/json" \
-d '{To retry the original request with payment:
```bash
PAYMENT=$(echo '{"x402Version":2,...}' | base64 -w0)
curl https://api.example.com/v1/endpoint \
-H "payment-signature: $PAYMENT"
```Check spending rules and sign an EIP-3009 USDC payment authorization for x402 protocol.
```bash
curl -X POST https://api.crowpay.ai/authorize \
-H "X-API-Key: crow_sk_..." \
-H "Content-Type: application/json" \
-d '{To retry the original request with payment:
```bash
PAYMENT=$(echo '{"x402Version":2,...}' | base64 -w0)
curl https://api.example.com/v1/endpoint \
-H "payment-signature: $PAYMENT"
```Request a credit card payment. Returns a Stripe Shared Payment Token.
```bash
curl -X POST https://api.crowpay.ai/authorize/card \
-H "X-API-Key: crow_sk_..." \
-H "Content-Type: application/json" \
-d '{Check wallet balance, spending rules, and daily spending. Returns all wallets and card payment methods for the authenticated user. ```bash curl "https://api.crowpay.ai/status" \ -H "X-API-Key: crow_sk_..." ```
Pass the **entire 402 response body** as `paymentRequired`, and add a clear `merchant` name and `reason`:
```bash
curl -X POST https://api.crowpay.ai/authorize \
-H "X-API-Key: crow_sk_abc123..." \
-H "Content-Type: application/json" \
-d '{### Responses **200 OK — Auto-approved** The signed payment payload. Use this to retry the original request.
2. Merchant blacklist 3. Merchant whitelist (if configured) 4. Daily spending limit 5. Auto-approve threshold (above threshold → 202 pending) ---
|------|---------| | Daily limit | $50 | | Per-transaction limit | $25 | | Auto-approve threshold | $5 | ---
|------|---------| | Daily limit | $50 (5000 cents) | | Per-transaction limit | $25 (2500 cents) | | Auto-approve threshold | $5 (500 cents) | Owners can customize all limits in the dashboard under the "Rules" tab.
The wallet owner sees the `merchant` and `reason` when approving, so make them descriptive. ## Step 3a: If 200 — Auto-approved Crow checked spending rules and $0.50 is within the auto-approve threshold. You get a signed payment payload:
- USDC contract: `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` - Crow signs EIP-3009 `TransferWithAuthorization` — the facilitator settles on-chain - The wallet's private key never leaves Crow's server - Default auto-approve threshold is $5 — owner can change this in dashboard
65/65 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal