41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill's instructions match its stated purpose (making paid x402 requests) but it relies on running npx awal@latest (which fetches and executes remote code) and it fails to declare required tooling...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1770843401932,
        "_id": "k97ee5s9cxmma2k3zq9hf9x1qd80zpq4",
        "changelog": "Initial release of pay-for-service skill.\n\n- Enables making paid API requests to x402 endpoints with automatic USDC payment on Base.\n- Provides command syntax and usage for npx awal@latest x402 pay.\n- Documents options for HTTP method, headers, data, query params, and max payment amount.\n- Outlines prerequisites: wallet authentication and sufficient USDC balance.\n- Includes usage examples and common error handling steps.\n- Designed to be used after discovering services via search-for-service.",
        "changelogSource": "auto",
        "createdAt": 1770843401932,
        "version": "0.1.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "0xRAG",
        "handle": "0xrag",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/15928227?v=4",
        "kind": "user",
        "linkedUserId": "kn7172tqys5cc867n3zq3xjyhs80y9m4"
    },
    "ownerHandle": "0xrag",
    "skill": {
        "_creationTime": 1770843401932,
        "_id": "kd72feqbeyspkgwjvbrr9sdhr180z8d1",
        "badges": [],
        "createdAt": 1770843401932,
        "displayName": "Pay For Service",
        "latestVersionId": "k97ee5s9cxmma2k3zq9hf9x1qd80zpq4",
        "ownerUserId": "kn7172tqys5cc867n3zq3xjyhs80y9m4",
        "slug": "pay-for-service",
        "stats": {
            "comments": 0,
            "downloads": 749,
            "installsAllTime": 5,
            "installsCurrent": 5,
            "stars": 0,
            "versions": 1
        },
        "summary": "Make a paid API request to an x402 endpoint with automatic USDC payment. Use when you or the user want to call a paid API, make an x402 request, use a paid service, or pay for an API call. Use after finding a service with search-for-service.",
        "tags": {
            "latest": "k97ee5s9cxmma2k3zq9hf9x1qd80zpq4"
        },
        "updatedAt": 1774324192214
    }
}