Pop Pay Skill

What This Skill Does#

Gives your OpenClaw agent the ability to pay at any online store using your own existing credit card — no account to create, no SaaS subscription, no external service to trust.

Your card number is stored in your local system keychain and is never placed in the agent's context window. When payment is approved, credentials are injected directly into the browser's payment form via CDP (Chrome DevTools Protocol — an open protocol maintained by Google) in a separate process — the agent never sees them. If your agent is compromised by a prompt injection attack, the attacker cannot steal your card.

---

Privacy & Data Flow#

All payment logic runs on your machine. There are no Point One Percent servers involved in the payment path.

ComponentDefaultData staysCard credentialsLocal system keychainYour machine onlySpend policy~/.config/pop-pay/.envYour machine onlyGuardrail enginekeyword mode (zero API calls)Your machine onlyGuardrail engine (optional)llm mode — uses your own API keyYour API providerWebhook notificationsDisabled by default — only active if POP_WEBHOOK_URL is setYour chosen endpoint

Keyword guardrail (default): evaluates transactions locally with no external calls. LLM guardrail (opt-in): uses your own POP_LLM_API_KEY — no data is sent to Point One Percent.

---

Setup (One Time)#

bash

# Install from PyPI (https://pypi.org/project/pop-pay/)
pip install pop-pay
pop-pay setup          # securely stores your card in the system keychain
pop-pay setup --profile   # stores billing info (name, address, email)

Then add to your OpenClaw config:

json

{
  "mcpServers": {
    "pop-pay": {
      "command": "pop-pay",
      "args": ["serve"]
    }
  }
}

Set your spend policy in ~/.config/pop-pay/.env:

text

POP_ALLOWED_CATEGORIES=["amazon","shopify","aws"]
POP_MAX_AMOUNT_PER_TX=100
POP_MAX_DAILY_BUDGET=300
POP_AUTO_INJECT=true          # set to false to review injections manually
POP_REQUIRE_HUMAN_APPROVAL=false  # set to true for manual confirmation on every payment

---

Tools#

request_purchaser_info#

When to call: You are on a contact/billing info page with fields for name, email, phone, or address — but no credit card fields are visible yet.

text

request_purchaser_info(
    target_vendor: str,   # e.g. "Amazon", "Shopify" — NOT a URL
    page_url: str,        # current browser page URL
    reasoning: str        # why you are filling this form
)

• Injects name, email, phone, and address from the user's stored profile
• Does NOT issue a card, does NOT charge anything, does NOT affect the budget
• After this completes, navigate to the payment page and call request_virtual_card

---

request_virtual_card#

When to call: You are on the checkout/payment page and credit card input fields are visible.

text

request_virtual_card(
    requested_amount: float,  # exact amount shown on screen
    target_vendor: str,       # e.g. "Amazon" — NOT a URL
    reasoning: str,           # explain why this purchase should happen
    page_url: str             # current checkout page URL
)

• Evaluates the purchase against the user's spend policy (amount limits, allowlist)
• Runs a guardrail check: evaluates whether this purchase should happen given the agent's current task context — not just whether it can (within budget)
• Automatically scans the checkout page for prompt injection attacks before issuing the card
• If approved, credentials are injected directly into the browser form via CDP — never passed to the agent
• Returns: approved (with last 4 digits) or rejected (with reason)

After approval: Click the submit/pay button. The card has been filled automatically.

---

Usage Flow#

text

Agent navigates to product page
  ↓
Agent clicks "Checkout" / "Proceed to payment"
  ↓
[If billing page appears first]
  → call request_purchaser_info(vendor, page_url, reasoning)
  → click Continue/Next
  ↓
[When payment/card fields are visible]
  → call request_virtual_card(amount, vendor, reasoning, page_url)
     (security scan runs automatically inside this call)
  ↓
[If approved]
  → click Submit / Place Order

---

Security Model#

Propertypop-payCard number in agent contextNeverStored locally (no external account)Yes — system keychainWorks with existing credit cardYesWorks with any merchantYes (any checkout form)No SaaS / no login requiredYesGuardrail (SHOULD vs CAN)Yes — keyword or LLM modePrompt injection scan on every paymentYes — automaticOpen source / auditableMIT

Prompt injection resistance: The card is injected by a separate local process (CDP injector) that activates only after guardrail approval. A malicious merchant cannot steal the card via hidden DOM instructions — the agent never had it.

---

Spend Policy Reference#

Env varDefaultDescriptionPOP_ALLOWED_CATEGORIES``[]JSON array of allowed vendor keywordsPOP_MAX_AMOUNT_PER_TXrequiredMax per transaction (USD)POP_MAX_DAILY_BUDGETrequiredMax total spend per day (USD)POP_GUARDRAIL_ENGINE``keyword``keyword (local, zero API cost) or llm (semantic, needs API key)POP_REQUIRE_HUMAN_APPROVAL``falseAlways require human confirmation before paymentPOP_AUTO_INJECT``trueEnable CDP auto-injection into checkout formsPOP_WEBHOOK_URL_(disabled)_Optional: POST notifications to Slack/Teams/PagerDuty

---

Example: Agent Buys Office Supplies on Amazon#

python

# Agent has been asked: "Order a USB-C hub from Amazon, around $40"

# Step 1: Navigate to Amazon, find the product, add to cart, proceed to checkout

# Step 2: On billing info page
result = request_purchaser_info(
    target_vendor="Amazon",
    page_url="https://www.amazon.com/checkout/address",
    reasoning="Filling billing address for USB-C hub purchase as instructed by user"
)
# → Billing info injected. Click Continue.

# Step 3: On payment page — security scan runs automatically inside this call
result = request_virtual_card(
    requested_amount=43.99,
    target_vendor="Amazon",
    reasoning="Purchasing USB-C hub for home office setup as instructed by user",
    page_url="https://www.amazon.com/checkout/payment"
)
# → Approved. Card injected via CDP. Click "Place your order".

---

GitHub#

github.com/TPEmist/Point-One-Percent