agent-payment-x402
Add x402 payment execution to AI agents with per-task budgets, spending controls, and non-custodial wallets. Supports Base through agentwallet-sdk and X Layer through OKX Payments / OKX Agent Payments Protocol. Use when an agent must pay for something itself and needs per-task budgets, spending controls, and a non-custodial wallet.
72
88%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Medium
Suggest reviewing before use
Security
1 medium severity finding. This skill can be installed but you should review these findings before use.
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
The skill is explicitly a payments integration: it describes the x402 payment protocol, non-custodial wallet usage (agents holding keys / signing transactions), and exposes agent-callable payment tools such as "send_payment" and "get_balance". It references concrete payment SDKs (agentwallet-sdk, OKX payments) and shows MCP/tool configuration for running a payment server with wallet private keys. These are specific, purpose-built financial execution capabilities (sending payments, signing transactions, integrating with payment gateways/chain settlement), so this grants Direct Financial Execution Authority.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill explicitly instructs fetching runtime guides from raw GitHub URLs (e.g., https://raw.githubusercontent.com/okx/payments/main/typescript/SELLER.md) to "fetch the latest guide before generating code" and also runs/installs an unpinned runtime package via npx (agentwallet-sdk referenced at https://www.npmjs.com/package/agentwallet-sdk), meaning external content is fetched at runtime and can directly drive prompt-driven code generation or execute remote code.
- Repository
- affaan-m/ECC
- Commit
06c5e11
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.