showmethemoney-lite

paid stablepay demo skill for openclaw. use when the user wants to try a monetized skill flow with a visible price, stablepay wallet setup, and in-chat payme...

Security Scan

An instruction-only demo skill that guides a StablePay payment flow; its requirements and instructions match its stated demo purpose, though it can trigger real payments and is explicitly weak on purchase enforcement.

Purpose & Capability

The name/description (StablePay paid demo) align with the SKILL.md: it instructs the agent to use StablePay runtime calls, a local wallet, and an optional demo backend. No unrelated environment variables, binaries, or install steps are requested.

Instruction Scope

Instructions stay within the paid-demo scope (preflight checks, wallet creation, payment API calls, handling HTTP 402, requiring backend confirmation). Caution: the skill can initiate real payments and create/modify local wallet state if the StablePay plugin is present; it does require explicit user request for the paid action and states not to invent purchases.

Install Mechanism

Instruction-only skill with no install spec and no code files. Nothing is written to disk by the skill package itself.

Credentials

No environment variables, credentials, or config paths are requested. The skill relies on the presence of the StablePay plugin and a local wallet runtime, which is coherent for its purpose.

Persistence & Privilege

always is false and the skill does not request persistent or elevated platform privileges or modifications to other skills' configurations.

Assessment

This skill appears internally consistent for a demo payment flow, but before installing consider: 1) it can trigger real payments — only run paid demo actions after explicit user consent; 2) it relies on the StablePay plugin and local wallet runtime — verify those components' provenance and trustworthiness (a compromised plugin could misuse keys or initiate payments); 3) placeholders in SKILL.md must be replaced before production use, and the skill itself is described as 'weak-protection' (not tamper-resistant) so do not treat it as a secure commercial payment integration; 4) test in a sandbox or with test funds first and monitor any transactions; 5) if you need strict backend enforcement or strong anti-tamper guarantees, choose a different skill or require server-side verification. If you want higher confidence about safety, ask the publisher for the real demo endpoints, the StablePay plugin source, and any backend implementation details.

Provide a weak-protection paid demo skill that can guide the user through a StablePay purchase flow for a lightweight premium action.

Merchant configuration

Use the following merchant placeholders for this skill:

• skill_name: {{SKILL_NAME}}
• skill_did: {{SKILL_DID}}
• default_price_usdc: {{PRICE_USDC}}
• currency: {{CURRENCY}}
• stablepay_gateway_base_url: {{STABLEPAY_GATEWAY_BASE_URL}}
• lite_preview_endpoint: {{LITE_PREVIEW_ENDPOINT}}
• lite_paid_demo_endpoint: {{LITE_PAID_DEMO_ENDPOINT}}

Replace all placeholders before publishing a real version.

Required runtime assumptions

Proceed only if all of the following are true:

• the StablePay plugin is installed and enabled
• a local wallet runtime is available
• the StablePay backend is reachable
• this skill's demo endpoint is reachable if the paid demo action needs it

If any dependency is missing, explain what is unavailable and stop.

Preflight workflow

Before attempting any paid action:

1. Call stablepay_runtime_status
2. If no local wallet exists, call stablepay_create_local_wallet
3. If no backend DID is registered, call stablepay_register_local_did
4. If payment limits are missing, call stablepay_configure_payment_limits
5. If no payment policy exists, call stablepay_build_payment_policy

Do not continue to the paid action if wallet setup, DID registration, or payment policy setup is incomplete.

Public preview behavior

When the user asks what this skill does, provide a free preview first.

The free preview may include:

• a short explanation of the demo
• a teaser result
• a sample response showing what the premium result would look like

Do not claim that the free preview means the user has purchased the premium action.

Paid demo behavior

When the user explicitly requests the paid demo action:

1. Explain that this skill requires payment for the premium demo action.
2. Show the configured price and currency using:
   • price: {{PRICE_USDC}}
   • currency: {{CURRENCY}}
   • skill_did: {{SKILL_DID}}
3. Attempt the paid demo endpoint if one exists.
4. If the backend or demo flow returns HTTP 402 Payment Required, explain that payment is required.
5. Use the StablePay plugin to complete payment:
   • prefer stablepay_pay_via_gateway
   • use stablepay_execute_paid_skill_demo only for the dedicated demo route
6. Only continue after the StablePay backend confirms purchase or payment completion.
7. After payment succeeds, retry the premium demo action once.
8. If payment fails, verification fails, or the retry still fails, stop and explain the failure.

Purchase integrity rules

• Treat local wallet state and local policy state as setup information only.
• Do not treat local state as proof of purchase.
• Treat StablePay backend confirmation as the source of truth for whether payment succeeded.
• Do not claim purchase success unless the backend or payment response confirms it.

Intended protection level

This skill is a weak-protection paid skill.

That means:

• it may still use StablePay and trigger a real payment flow
• it is suitable for demos and lightweight premium actions
• it does not rely on strict backend verification for every protected capability
• it should not be presented as a fully tamper-resistant commercial skill

Safety

• Never expose private keys, mnemonic material, decrypted local state, API keys, or backend secrets.
• Never invent a successful purchase.
• Treat local payment limits as user protection only.
• Never bypass StablePay when this skill declares that a premium action is paid.