💸 Payclaw — 代理商之间的 USDC 支付
v1.0.0Payclaw 允许 OpenClaw 代理商创建 USDC 钱包、发送和接收支付、以及在代理商之间进行托管。为 Moltbook 的 USDC 黑客马拉松而构建。
0· 962·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
high confidence该技能基本符合其声明的目的（Circle 钱包工具的 CLI 包装），但存在多个一致性和安全问题，安装前应了解。
评估建议
该技能是对外部 'circle-wallet' 工具的 CLI 包装，需要提供 Circle API 密钥（存储在 ~/.openclaw/payclaw/config.json 中）。安装前：（1）验证信任作者/仓库；（2）确保意图安装和运行外部 'circle-wallet' 二进制文件；（3）注意 CLI 通过插值用户提供的值构造 shell 命令，输入未经清洗，可能导致命令注入；（4）注意 SKILL.md 显示的程序导入（PayClaw 类）在提供的代码中不存在；（5）如果继续，考虑在受限环境（容器/VM）中运行，并检查/修改代码以清洗输入。若不信任源或无法验证外部二进制文件，视为高风险。...详细分析 ▾
⚠ 用途与能力
The code implements a CLI that delegates work to an external 'circle-wallet' command and stores a Circle API key in ~/.openclaw/payclaw/config.json. However, the skill metadata declares no required binaries, no credentials, and no config paths — those are required in practice. Also the SKILL.md suggests importing a PayClaw class from 'payclaw' for programmatic agent integration, but the distributed code is only a CLI (no exported library API). These mismatches mean the declared purpose is plausible but the manifest omits key requirements and the integration example is inaccurate.
⚠ 指令范围
The runtime instructions and code tell the agent/user to: install/build/link the package, run 'payclaw setup --api-key YOUR_CIRCLE_API_KEY' (so an API key is required), create wallets, register agents, and run payments. The implementation executes shell commands via execSync(`circle-wallet ${cmd}`) with user-provided inputs (addresses, amounts, arbitrary command fragments) and writes/reads files under ~/.openclaw/payclaw (config.json, escrows.json, agents.json, history.json). There is no input sanitization for values interpolated into the shell call, creating command‑injection risk. The SKILL.md and package manifest do not declare the required HOME config path access or the need for the external 'circle-wallet' binary.
ℹ 安装机制
There is no remote download/install spec in the registry (the skill is instruction-only), but the package includes full source and a built CLI. Install instructions in SKILL.md use npm install && npm run build && npm link — a typical local install that will place files on disk. No suspicious external URLs or archives are used in the install flow.
⚠ 凭证需求
The skill does require a Circle API key (SKILL.md shows payclaw setup --api-key) but the registry metadata lists no required environment variables or primary credential. The code instead persists the API key to ~/.openclaw/payclaw/config.json (file mode 600 is applied). The skill also relies on a 'circle-wallet' binary (not declared). The absence of declared credentials/binaries in the metadata is a coherence issue and could mislead users about what sensitive values the skill needs.
✓ 持久化与权限
The skill writes its own config and data into ~/.openclaw/payclaw and does not request always:true or other elevated privileges. It does not modify other skills' configurations. Autonomous invocation is allowed by platform default, which is expected; no additional persistence privileges are requested.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/8
初始发布
● 可疑
安装命令
点击复制官方npx clawhub@latest install payclaw
镜像加速npx clawhub@latest install payclaw --registry https://cn.longxiaskill.com
技能文档
功能
PayClaw 启用任何 OpenClaw 代理商：- 🏦 创建 USDC 钱包（Circle 开发者控制钱包）
- 💰 从其他代理商或人类接收支付
- 💸 发送支付到任何钱包地址
- 🤝 之间的代理商托管资金用于无信任交易
- 🔗 在 Arc 测试网（USDC 本地 L1）上工作
...（以下内容与原文相同，仅翻译了标题和简要描述，详见原文）