Pop Pay Skill

name: pop-pay version: "0.6.23" description: "Your card stays on your PC — no SaaS, no login, no external account. Credentials inject directly, keeping them out of the AI's context window." homepage: https://github.com/TPEmist/Point-One-Percent author: Point One Percent license: MIT requires: bins: - pop-pay env: - POP_ALLOWED_CATEGORIES - POP_MAX_AMOUNT_PER_TX - POP_MAX_DAILY_BUDGET - POP_AUTO_INJECT - POP_REQUIRE_HUMAN_APPROVAL - POP_GUARDRAIL_ENGINE

What This Skill Does

Gives your OpenClaw agent the ability to pay at any online store using your own existing credit card — no account to create, no SaaS subscription, no external service to trust.

Your card number is stored in your local system keychain and is never placed in the agent's context window. When payment is approved, credentials are injected directly into the browser's payment form via CDP (Chrome DevTools Protocol — an open protocol maintained by Google) in a separate process — the agent never sees them. If your agent is compromised by a prompt injection attack, the attacker cannot steal your card.

Privacy & Data Flow

All payment logic runs on your machine. There are no Point One Percent servers involved in the payment path.

Keyword guardrail (default): evaluates transactions locally with no external calls. LLM guardrail (opt-in): uses your own POP_LLM_API_KEY — no data is sent to Point One Percent.

Setup (One Time)

# Install from PyPI (https://pypi.org/project/pop-pay/)
pip install pop-pay
pop-pay setup          # securely stores your card in the system keychain
pop-pay setup --profile   # stores billing info (name, address, email)

Then add to your OpenClaw config:

{
  "mcpServers": {
    "pop-pay": {
      "command": "pop-pay",
      "args": ["serve"]
    }
  }
}

Set your spend policy in ~/.config/pop-pay/.env:

POP_ALLOWED_CATEGORIES=["amazon","shopify","aws"]
POP_MAX_AMOUNT_PER_TX=100
POP_MAX_DAILY_BUDGET=300
POP_AUTO_INJECT=true          # set to false to review injections manually
POP_REQUIRE_HUMAN_APPROVAL=false  # set to true for manual confirmation on every payment

Tools

request_purchaser_info

When to call: You are on a contact/billing info page with fields for name, email, phone, or address — but no credit card fields are visible yet.

request_purchaser_info(
    target_vendor: str,   # e.g. "Amazon", "Shopify" — NOT a URL
    page_url: str,        # current browser page URL
    reasoning: str        # why you are filling this form
)

• Injects name, email, phone, and address from the user's stored profile
• Does NOT issue a card, does NOT charge anything, does NOT affect the budget
• After this completes, navigate to the payment page and call request_virtual_card

request_virtual_card

When to call: You are on the checkout/payment page and credit card input fields are visible.

request_virtual_card(
    requested_amount: float,  # exact amount shown on screen
    target_vendor: str,       # e.g. "Amazon" — NOT a URL
    reasoning: str,           # explain why this purchase should happen
    page_url: str             # current checkout page URL
)

• Evaluates the purchase against the user's spend policy (amount limits, allowlist)
• Runs a guardrail check: evaluates whether this purchase should happen given the agent's current task context — not just whether it can (within budget)
• Automatically scans the checkout page for prompt injection attacks before issuing the card
• If approved, credentials are injected directly into the browser form via CDP — never passed to the agent
• Returns: approved (with last 4 digits) or rejected (with reason)

After approval: Click the submit/pay button. The card has been filled automatically.

Usage Flow

Agent navigates to product page
  ↓
Agent clicks "Checkout" / "Proceed to payment"
  ↓
[If billing page appears first]
  → call request_purchaser_info(vendor, page_url, reasoning)
  → click Continue/Next
  ↓
[When payment/card fields are visible]
  → call request_virtual_card(amount, vendor, reasoning, page_url)
     (security scan runs automatically inside this call)
  ↓
[If approved]
  → click Submit / Place Order

Security Model

小蔥技能7w4.net有完整的技能分類。

Prompt injection resistance: The card is injected by a separate local process (CDP injector) that activates only after guardrail approval. A malicious merchant cannot steal the card via hidden DOM instructions — the agent never had it.

Spend Policy Reference

Example: Agent Buys Office Supplies on Amazon

# Agent has been asked: "Order a USB-C hub from Amazon, around $40"

# Step 1: Navigate to Amazon, find the product, add to cart, proceed to checkout

# Step 2: On billing info page
result = request_purchaser_info(
    target_vendor="Amazon",
    page_url="https://www.amazon.com/checkout/address",
    reasoning="Filling billing address for USB-C hub purchase as instructed by user"
)
# → Billing info injected. Click Continue.

# Step 3: On payment page — security scan runs automatically inside this call
result = request_virtual_card(
    requested_amount=43.99,
    target_vendor="Amazon",
    reasoning="Purchasing USB-C hub for home office setup as instructed by user",
    page_url="https://www.amazon.com/checkout/payment"
)
# → Approved. Card injected via CDP. Click "Place your order".

GitHub

github.com/TPEmist/Point-One-Percent

這個 Skill 質量不錯，隱私保護和支付安全方面做得相當用心——你的信用卡號不會被 AI 看到，資訊直接本地處理，不會洩露給第三方。文件寫得清楚明白，安全模型解釋得詳細。但它需要先安裝額外的軟體包才能用，配置過程對普通使用者來說有一定技術門檻，文件裡缺少故障排查指南和實際執行效果的演示。總體適合有一定動手能力的使用者。