PayTrigo (OpenClawBot, Base/USDC)

This skill mostly does what it says (creates invoices, returns intents, polls status), but exercise caution before installing or running it: - Do not rely on the embedded API keys. Treat the hardcoded 'sk_live_...' values as secrets that could be abused by whoever controls them. Prefer to replace them with your own platform key (provided securely) or modify the code to read a key from a protected environment variable. - Verify the source. The skill has no homepage and an unknown source; confirm you trust the author before using keys embedded in their code. - Avoid passing raw private keys on the command line (use encrypted wallet files and passphrases). Passing a private key via --pk can expose it in process listings; use the encrypted wallet store and supply passphrases via a file with strict permissions. - Review and, if desired, remove or rotate any embedded keys before running in production. Test with minimal amounts and in an isolated environment first. - If you need this functionality but don't want to trust embedded credentials, fork the code, remove the hardcoded keys, and inject your API key via env vars or a secure secrets mechanism. If you want, I can help produce a safe checklist or provide a patched version of the scripts that reads API keys from environment variables and warns if a hardcoded key is present.