pop-pay— agent skill

What This Skill Does

Gives your OpenClaw agent the ability to pay at any online store using your own existing credit card. The card number is stored in a local encrypted vault (AES-256-GCM) and is never placed in the agent's context window. When a payment is approved, credentials are injected directly into the checkout form via Chrome DevTools Protocol (CDP) in a separate local process — if the agent is compromised by prompt injection, the attacker cannot steal the card it never saw.

Tagline: _it only takes 0.1% of hallucination to drain 100% of your wallet._

Privacy & Data Flow

All payment logic runs on your machine. There are no Point One Percent / A Hundred Percent Inc. servers in the payment path.

Setup (One Time)

Install from npm (https://www.npmjs.com/package/pop-pay):

# No install needed — run on demand via npx
npx -y pop-pay pop-init-vault

Or install globally:

npm install -g pop-pay
pop-init-vault

For stronger protection (recommended — blocks any agent with shell access):

npx -y pop-pay pop-init-vault --passphrase   # one-time setup
npx -y pop-pay pop-unlock                     # run once before each session

Add to your OpenClaw MCP config (or ~/.openclaw/mcp_servers.json):

{
  "mcpServers": {
    "pop-pay": {
      "command": "npx",
      "args": ["-y", "pop-pay", "launch-mcp"],
      "env": {
        "POP_CDP_URL": "http://localhost:9222"
      }
    }
  }
}

Or via the OpenClaw CLI:

openclaw mcp add pop-pay -- npx -y pop-pay launch-mcp

Then launch Chrome with CDP:

npx -y pop-pay launch

Installed Binaries

MCP Tools

request_virtual_card

When to call: You are on a checkout/payment page and credit card input fields are visible.

Parameters:

• requested_amount (number, USD) — exact amount shown on screen
• target_vendor (string) — e.g. "Amazon" (NOT a URL)
• reasoning (string) — why this purchase should happen
• page_url (string) — current checkout page URL

Behavior:

• Evaluates purchase against spend policy (amount, daily cap, allowlist)
• Runs a guardrail check (SHOULD vs CAN) — keyword or LLM mode
• Scans the page for hidden prompt injections before issuing the card
• If approved, injects credentials directly into the form via CDP — never passed to the agent
• Returns approved (with last 4 digits) or rejected (with reason)

After approval: click Submit / Place Order. Card has already been filled.

request_purchaser_info

When to call: You are on a billing/contact form with name, email, phone, or address fields but no credit card fields yet.

Parameters:

• target_vendor (string)
• page_url (string)
• reasoning (string)

Injects name, email, phone, address from the user's stored profile. Does NOT issue a card, does NOT charge, does NOT affect the budget.

request_x402_payment

When to call: Paying for an API call that returns HTTP 402 under the x402 protocol.

Parameters:

• endpoint (string) — the API URL that returned 402
• amount (number, USD)
• reasoning (string)

Handles the x402 handshake and payment without exposing credentials to the agent.

Usage Flow

Agent navigates to product page
  ↓
Clicks "Checkout" / "Proceed to payment"
  ↓
[If billing page first]
  → request_purchaser_info(vendor, page_url, reasoning)
  → click Continue
  ↓
[Payment/card fields visible]
  → request_virtual_card(amount, vendor, reasoning, page_url)
     (injection scan runs inside this call)
  ↓
[Approved]
  → click Submit / Place Order

Security Model

Full STRIDE analysis: THREAT_MODEL.md

Spend Policy Reference

Full reference: ENV_REFERENCE.md

Providers

Priority: Stripe Issuing → BYOC Local → Mock.

Links

• npm: https://www.npmjs.com/package/pop-pay
• GitHub: https://github.com/100xPercent/pop-pay
• MCP Registry: io.github.100xPercent/pop-pay
• License: MIT