Bank Claw | Give your agent a bank account

Name/description (agentic wallets/Stripe-backed payments) align with the declared requirement (CREDITCLAW_API_KEY) and the runtime instructions (curl calls to creditclaw.com endpoints for purchases, check, top-up, checkout, stripe wallet signing). The required credential is the expected one for a payment API.

SKILL.md and companion files explicitly tell the agent to call CreditClaw API endpoints (e.g., /bot/wallet/check, /card-wallet/bot/purchase, /bot/merchant/checkout) and to poll for status, perform variant lookups, and optionally download skill files into ~/.creditclaw/skills/creditcard. Those behaviors are appropriate for a payments/checkout skill, but they do allow the agent to (with a valid API key) initiate real charges and to write these skill files locally. The skill also instructs the agent to search the web for product pages (e.g., extract ASINs) which is within scope for shopping.

No install spec or third-party downloads are included; the skill is instruction-only. The suggested 'install' uses curl to mirror files from creditclaw.com into a local skill directory — this writes documentation locally but does not fetch arbitrary code or run installers. Low install risk.

Only one environment variable (CREDITCLAW_API_KEY) is required and is declared as the primary credential. That is proportionate for a payment/wallet integration. The SKILL.md consistently uses that key only in requests to creditclaw.com and explicitly warns not to send it to other domains.

The skill is not forced-always (always: false) and allows normal autonomous invocation. It does instruct how to store skill files under the user's home (~/.creditclaw/skills/creditcard) but does not request system-wide privileges or modify other skills' configs. This level of persistence is reasonable for an instruction-only payment skill.