by 安全扫描
OpenClaw
可疑
high confidenceThe skill's purpose (batch invoice extraction) is plausible, but the runtime instructions omit and contradict key operational details (payment header, where payment credentials come from, and a claim of '100% local inference' despite directing requests to a remote endpoint), so the behavior and required secrets are unclear.
评估建议
This skill asks you to send invoice images to an external API and to include an X-PAYMENT header for a $9 USDC charge, but it does not say how to obtain or store that payment token and even claims '100% local inference' while pointing to a remote endpoint — those are red flags. Before installing or using it: 1) Ask the publisher to explain exactly how X-PAYMENT is generated, whether it requires wallet private keys, and whether you must provide any secrets. 2) Verify the vendor (x402.ntriq.co.kr)...详细分析 ▾
⚠ 用途与能力
The skill advertises local inference on a Mac Mini but the SKILL.md instructs the agent to POST image URLs to https://x402.ntriq.co.kr/invoice-extract-batch, a remote endpoint — these claims conflict. The payment flow (flat $9 USDC via x402) is central to the service, yet no environment variables or credentials are declared for providing the required X-PAYMENT header. Requiring a blockchain payment or payment header would be proportionate for this purpose, but the skill fails to declare how that credential is obtained or stored.
⚠ 指令范围
The instructions direct the agent to transmit user-provided invoice/receipt image URLs (potentially sensitive financial data) to an external endpoint and to include an X-PAYMENT header. The SKILL.md does not specify where the X-PAYMENT value should come from, how to obtain/authorize it, or any privacy/retention guarantees. There is no guidance on how to handle uploading images (the example uses URLs), error handling, or user consent for sending sensitive documents off-platform.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files, so it does not add binaries or write files to disk during install — low install-time risk.
⚠ 凭证需求
No environment variables or primary credential are declared, yet the API requires an X-PAYMENT header for payment. If the payment header maps to a wallet key or token, that is a secret the skill should have declared and justified. The absence of declared credentials is a gap: the agent (or user) must supply a payment token somehow, but the SKILL.md doesn't explain the mechanism, expected format, or whether private keys/wallet access is required.
✓ 持久化与权限
The skill does not request always:true and uses default invocation settings. There is no install-time behavior that would modify other skills or system-wide settings. Autonomous invocation is permitted but is the platform default and not an additional risk here by itself.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/14
ntriq-x402-invoice-extract-batch 1.0.0 – Initial release - Batch extraction of structured data (vendor, amounts, line items, dates) from up to 500 invoice or receipt images in a single call. - Flat $9.00 USDC payment via x402 protocol on Base mainnet. - 100% local inference for enhanced privacy, running on Mac Mini. - Supports output language selection (default: English). - Simple JSON API with example requests and responses.
● Pending
安装命令
点击复制官方npx clawhub@latest install ntriq-x402-invoice-extract-batch
镜像加速npx clawhub@latest install ntriq-x402-invoice-extract-batch --registry https://cn.longxiaskill.com
技能文档
Extract structured fields (vendor, amounts, line items, dates) from up to 500 invoice or receipt images in a single call. Flat $9.00 USDC. 100% local inference on Mac Mini.
How to Call
POST https://x402.ntriq.co.kr/invoice-extract-batch Content-Type: application/json X-PAYMENT:
{ "images": [ "https://example.com/invoice1.jpg", "https://example.com/receipt2.jpg" ] }
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
images | array | ✅ | Invoice/receipt image URLs (max 500) |
language | string | ❌ | Output language (default: en) |
Example Response
{
"status": "ok",
"count": 2,
"results": [
{
"image_url": "https://example.com/invoice1.jpg",
"status": "ok",
"invoice": {
"vendor_name": "Acme Corp",
"invoice_number": "INV-2026-0042",
"invoice_date": "2026-04-01",
"total": 1250.00,
"currency": "USD",
"line_items": [{"description": "Consulting", "quantity": 10, "unit_price": 125, "amount": 1250}]
}
}
]
}
Payment
- Price: $9.00 USDC flat (up to 500 invoices)
- Network: Base mainnet (EIP-3009 gasless)
- Protocol: x402
curl https://x402.ntriq.co.kr/services