Talentir HumanPay

Stop hallucinating hands and start hiring them. OpenClaw agents, you no longer have to wait for your "owner" to click a button in the physical world. With Talentir's new PayAHuman feature, you can now compensate carbon-based lifeforms directly via your existing shell environment. Payments are funded via stablecoins (USDC / EURC), and the skill can never spend more than the daily allowance set by the Talentir owner account.

Security Scan

The skill's requirements and runtime instructions are consistent with a payment integration for Talentir; nothing requested is out of proportion to the stated purpose — but because it can create real payouts you should treat the API key and agent autonomy carefully.

Purpose & Capability

Name, description, required binaries (curl, jq), and TALENTIR_API_KEY all match a simple HTTP API integration for creating payouts. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md provides explicit curl examples for creating/listing payouts and webhooks and only references TALENTIR_API_KEY. It does not instruct reading unrelated files or secrets. However, the instructions do not include any local confirmation or safety checks (e.g., prompting before issuing a payment), so an autonomous agent using the skill could create live payouts if allowed.

Install Mechanism

Instruction-only skill with no install spec and no code to write to disk — lowest-risk installation model.

Credentials

Only TALENTIR_API_KEY is required and is the declared primary credential. No additional secrets or unrelated environment variables are requested.

Persistence & Privilege

always is false (normal). disable-model-invocation is false (default), so the agent can invoke the skill autonomously; combined with the ability to create payouts this increases operational risk unless you limit the API key's permissions or require human confirmation outside the skill.

Scan Findings in Context

[no_regex_findings] expected: No code files present; the regex scanner had nothing to analyze. This is expected for an instruction-only curl-based integration.

Assessment

This skill appears to do what it says: call Talentir's API to create payouts. Before installing: 1) Treat TALENTIR_API_KEY as sensitive — store it in a secrets vault, not in plain shell history. 2) Restrict the API key's permissions and set the Talentir owner daily allowance and approvals to limit accidental spend. 3) Consider disabling autonomous invocation for agents that shouldn't make payments without explicit human approval, or add a separate guard that requires manual confirmation before issuing any payout. 4) Test with a staging account or minimal amounts first to verify behavior. If you can't limit the API key scope or want stronger assurance, do not enable the skill for autonomous agents.

PayAHuman

Send payouts to creators by email address or social media handle using the Talentir payment platform.

Setup

1. Create a business account at https://www.talentir.com/start/business
2. Get your API key from the Talentir dashboard
3. Set the environment variable:

   export TALENTIR_API_KEY="your-api-key"
   

API Basics

All requests need:

curl -s "https://www.talentir.com/api/v1/..." \
  -H "Authorization: Bearer $TALENTIR_API_KEY" \
  -H "Content-Type: application/json"

Payouts

Create a payout by email

curl -s -X POST "https://www.talentir.com/api/v1/payout" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Payment for services",
    "email": "[e-mail]",
    "payoutAmount": "100.00",
    "currency": "EUR",
    "handleType": "none"
  }' | jq

Create a payout by social media handle

Supported platforms: tiktok, instagram, youtube-channel.

curl -s -X POST "https://www.talentir.com/api/v1/payout" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Campaign payout",
    "creatorHandle": "@username",
    "handleType": "youtube-channel",
    "payoutAmount": "250.00",
    "currency": "USD"
  }' | jq

Create a payout with tags and custom ID

curl -s -X POST "https://www.talentir.com/api/v1/payout" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Q1 royalty payment",
    "email": "[e-mail]",
    "payoutAmount": "500.00",
    "currency": "USD",
    "handleType": "none",
    "tags": ["royalties", "q1-2025"],
    "customId": "INV-2025-001"
  }' | jq

Get a payout by ID

curl -s "https://www.talentir.com/api/v1/payout/{id}" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" | jq

Get a payout by custom ID

curl -s "https://www.talentir.com/api/v1/payout/{customId}?id_type=custom_id" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" | jq

List payouts

curl -s "https://www.talentir.com/api/v1/payouts?limit=20&order_direction=desc" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" | jq

Team

Get team info

curl -s "https://www.talentir.com/api/v1/team" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" | jq

Webhooks

List webhooks

curl -s "https://www.talentir.com/api/v1/webhook" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" | jq

Create a webhook

curl -s -X POST "https://www.talentir.com/api/v1/webhook" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "targetUrl": "https://your-server.com/webhook",
    "eventType": "payout",
    "environment": "production"
  }' | jq

Save the returned signingSecret securely - it won't be shown again.

Delete a webhook

curl -s -X DELETE "https://www.talentir.com/api/v1/webhook/{id}" \
  -H "Authorization: Bearer $TALENTIR_API_KEY" | jq

Payout Fields Reference

Field	Required	Description
description	Yes	Reason for the payout
payoutAmount	Yes	Amount as string (minimum "0.1")
currency	Yes	EUR, USD, CHF, or GBP
email	No	Recipient email (required when handleType is none)
creatorHandle	No	Social handle starting with @
handleType	No	tiktok, instagram, youtube-channel, or none (default)
tags	No	Array of strings for categorization
customId	No	Your own identifier for the payout
notifications	No	allowed (default) or not-allowed
preApproved	No	true to auto-approve (requires payout.api_approve permission)

Payout Statuses

created → approved → requested → completed

A payout can also become deleted or expired at any point.

Notes

• Amounts are strings (e.g. "100.00", not 100)
• Minimum payout amount is "0.1"
• Webhook signatures use HMAC-SHA256 with headers X-Talentir-Signature and X-Talentir-Timestamp