by 安全扫描
OpenClaw
可疑
medium confidenceThe skill claims to autonomously execute and route real-world payments but provides no details about how or where those payments would be executed (no credentials, endpoints, or install hooks), which is an important incoherence the user should review before installing.
评估建议
This skill's text shows how an Accounts Payable agent would behave, but it does not say how it would actually send money. Before installing or enabling it: 1) Ask the publisher which concrete payment integrations or platform tools implement payments.send and similar calls; require explicit documentation of where API keys or wallet credentials are stored and who controls them. 2) Do not grant any payment credentials (bank APIs, Stripe, wallet private keys, exchange keys) to this skill until you c...详细分析 ▾
⚠ 用途与能力
The skill's stated purpose is to execute payments across ACH, wire, crypto, stablecoin, and payment APIs. However, the bundle declares no required environment variables, no credentials, and no integration points. A genuine payment-capable agent would normally require API keys, wallet credentials, bank connectivity, or at least declarations of the external tool(s) it expects to call.
ℹ 指令范围
SKILL.md and AGENTS.md contain detailed runtime pseudocode that calls functions like payments.send, payments.checkByReference, getScheduledPayments, lookupVendor, payments.getHistory. Those instructions presume existing platform/tooling that provides those functions, but the skill does not specify or bind to any such tooling, credentials, or endpoints. The instructions do not ask for unrelated system files or secrets beyond the missing payment integrations.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files to execute. That minimizes on-disk risk; nothing is downloaded or installed by the skill itself.
⚠ 凭证需求
Given the payment capabilities described, the absence of any declared environment variables, keys, or config paths is disproportionate. Real payment operations require sensitive credentials (bank/PSP API keys, wallet private keys, webhook endpoints) but none are requested or documented here.
✓ 持久化与权限
The skill is not marked always:true and is user-invocable; it does not request permanent platform privileges or claim to modify other skills. Allowing autonomous invocation (default) is normal but increases blast radius if the skill were later wired to credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/10
- Initial release of agency-accounts-payable-agent. - Automates vendor and contractor payments with strict idempotency safeguards. - Maintains detailed audit trails for all payments and discrepancies. - Integrates seamlessly with other Agency agents for streamlined financial workflows. - Handles payment failures with retries, escalation, or human review.
● 无害
安装命令
点击复制官方npx clawhub@latest install agency-accounts-payable-agent
镜像加速npx clawhub@latest install agency-accounts-payable-agent --registry https://cn.longxiaskill.com