Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
The Agent Interoperability Bridge: Connecting GreenHelix Agents to x402, ACP, A2A, MCP, Visa TAP, Google AP2/UCP, PayPal Agent Ready, and OpenAI ACP Ecosystems
v1.2.0The Agent Interoperability Bridge: Connecting GreenHelix Agents to x402, ACP, A2A, MCP, Visa TAP, Google AP2/UCP, PayPal Agent Ready, and OpenAI ACP Ecosyste...
⭐ 0· 71·0 current·0 all-time
by@mirni
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and SKILL.md describe building protocol bridges for payments and agent identity; the listed credentials (WALLET_ADDRESS, AGENT_SIGNING_KEY, STRIPE_API_KEY) are plausible for that purpose. However, the registry metadata states no required env vars/credentials while the SKILL.md includes a 'credentials' list — this mismatch is unexpected and reduces confidence.
Instruction Scope
SKILL.md is an educational guide with illustrative Python examples and explicitly states it does not execute code. The instructions do not (in the provided excerpt) direct the agent to read arbitrary system files or exfiltrate data. No runtime steps are included that would require accessing unrelated system state.
Install Mechanism
No install spec and no code files — instruction-only. This minimizes install-time risk because nothing will be downloaded or executed by the platform during install.
Credentials
The SKILL.md requests sensitive secrets (AGENT_SIGNING_KEY and STRIPE_API_KEY). Those are logically relevant for implementing payment and signing flows, but: (1) the registry metadata does not list any required env vars, creating an inconsistency; (2) an instruction-only skill that asks for private signing keys risks accidental exposure if a user supplies them to the agent or stores them in a platform-accessible env. WALLET_ADDRESS is fine as a public address; STRIPE_API_KEY and AGENT_SIGNING_KEY should be scoped/test keys and handled locally.
Persistence & Privilege
always is false (normal) and disable-model-invocation is false (normal). Autonomous invocation is allowed by default; combined with the requested sensitive credentials this increases risk if users place secrets into agent-accessible environment variables, but the skill itself does not request permanent presence or modify other skills.
What to consider before installing
This is an instructional guide that plausibly needs payment and signing credentials to demonstrate end-to-end bridging, but there are two things to check before you proceed: (1) The registry metadata claims no required env/credentials while the SKILL.md lists three — ask the publisher (felix-agent) to explain where and how credentials are meant to be used and whether the skill ever accesses them at runtime. (2) Never paste or store your production private keys or live Stripe secret keys into a skill or chat. If you want to follow the guide: use local development only, use test/scoped API keys, keep signing private keys offline or in a hardware/security module, review the code snippets offline before copying them to any runtime, and rotate keys you used for testing. If you need assurance, request the missing author/homepage/source and an explicit statement that the skill will never attempt to read platform env/config — or insist the examples use clearly labeled test credentials and show safe key-handling patterns.Like a lobster shell, security has layers — review code before you run it.
a2avk97fk3y9nzctrbj4v5kjckn3as84ra0hacpvk97fk3y9nzctrbj4v5kjckn3as84ra0hagent-commercevk97fk3y9nzctrbj4v5kjckn3as84ra0hgoogle-ap2vk97fk3y9nzctrbj4v5kjckn3as84ra0hgreenhelixvk97fk3y9nzctrbj4v5kjckn3as84ra0hguidevk97fk3y9nzctrbj4v5kjckn3as84ra0hinteroperabilityvk97fk3y9nzctrbj4v5kjckn3as84ra0hlatestvk97fk3y9nzctrbj4v5kjckn3as84ra0hmcpvk97fk3y9nzctrbj4v5kjckn3as84ra0hopenai-acpvk97fk3y9nzctrbj4v5kjckn3as84ra0hpayment-routingvk97fk3y9nzctrbj4v5kjckn3as84ra0hpaypal-agent-readyvk97fk3y9nzctrbj4v5kjckn3as84ra0hprotocol-bridgevk97fk3y9nzctrbj4v5kjckn3as84ra0hucpvk97fk3y9nzctrbj4v5kjckn3as84ra0hvisa-tapvk97fk3y9nzctrbj4v5kjckn3as84ra0hx402vk97fk3y9nzctrbj4v5kjckn3as84ra0h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.