← All skills

Tencent SkillHub · Developer Tools

Soho

Initiate payments on the SOHO Pay credit layer using EIP-712 signatures.

skill openclawclawhub Free

0 Downloads

0 Stars

0 Installs

0 Score

High Signal

Initiate payments on the SOHO Pay credit layer using EIP-712 signatures.

⬇ 0 downloads ★ 0 stars Unverified but indexed

Install for OpenClaw

Quick setup

Download the package from Yavira.
Extract the archive and review SKILL.md first.
Import or place the package into your OpenClaw setup.

Requirements

Target platform: OpenClaw
Install method: Manual import
Extraction: Extract archive
Prerequisites: OpenClaw
Primary doc: SKILL.md

Package facts

Download mode: Yavira redirect
Package format: ZIP package
Source platform: Tencent SkillHub
What's included: package.json, skill.json, SKILL.md, _meta.json, src/pay.js, src/signer/config.js

Validation

Use the Yavira download entry.
Review SKILL.md after the package is downloaded.
Confirm the extracted package contains the expected setup assets.

Install with your agent

Agent handoff

Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.

Download the package from Yavira.
Extract it into a folder your agent can access.
Paste one of the prompts below and point your agent at the extracted folder.

New install

I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.

Upgrade existing

I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.

Open Send to Agent page Open JSON manifest Open Markdown brief

Trust & source

Release facts

Source: Tencent SkillHub
Verification: Indexed source record
Version: 2.0.0

Provenance

Publisher: max-clinch
Source page: View original listing
Canonical URL: Open canonical page

Documentation

ClawHub primary doc Primary doc: SKILL.md 20 sections Open source page

SOHO Pay — Credit Layer Payments

This skill orchestrates payments through the SOHO Pay Creditor smart contract using the spendWithAuthorization EIP-712 flow. This skill is manual-invocation only. It must not be triggered autonomously by a model. Every invocation requires explicit user confirmation.

Architecture — Three-Party Separation

┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐ │ Wallet Signer │ │ SoHo (Credit) │ │ Blockchain │ │ (user/operator) │ │ │ │ (Base) │ │ │ │ Credit checks │ │ │ │ Signs EIP-712 │────▶│ JIT funding │────▶│ Settlement │ │ Owns keys │ │ Authorization │ │ Creditor.sol │ │ │ │ │ │ │ │ MPC / HSM / │ │ NEVER signs │ │ │ │ Turnkey / Privy │ │ NEVER holds keys│ │ │ └──────────────────┘ └──────────────────┘ └──────────────────┘ SoHo is a credit layer only. It does not custody, hold, generate, or control any signing keys or key shards, and it does not produce EIP-712 signatures. All EIP-712 signatures come from a separate Wallet Signer owned and controlled by the user or agent operator (e.g., MPC provider like Turnkey/Privy/Fireblocks, or a user wallet). The skill orchestrates between: Wallet Signer — signing (user/operator-controlled) SoHo — credit checks + just-in-time funding (credit layer only) Blockchain — settlement

Usage

node scripts/pay.js <amount> <merchantAddress> [payerAddress] ArgumentDescriptionamountDecimal USDC value (e.g. 10, 0.5)merchantAddressExplicit 0x-prefixed EVM address (checksummed). Never a name.payerAddressRequired when SIGNER_PROVIDER=WALLET_SIGNER_REMOTE

Example — Base Sepolia with local key (dev only)

export RPC_URL=https://sepolia.base.org export CHAIN_ID=84532 export SIGNER_PROVIDER=LOCAL_PRIVATE_KEY export SOHO_DEV_PRIVATE_KEY=0xabc... node scripts/pay.js 10 0x1234567890abcdef1234567890abcdef12345678

Example — Base Sepolia with remote wallet signer (production pattern)

export RPC_URL=https://sepolia.base.org export CHAIN_ID=84532 export SIGNER_PROVIDER=WALLET_SIGNER_REMOTE export WALLET_SIGNER_SERVICE_URL=https://your-mpc-signer.example.com export SIGNER_SERVICE_AUTH_TOKEN=sk_live_... node scripts/pay.js 10 0xMERCHANT... 0xPAYER...

Workflow

Validate config — all env vars checked with Zod at startup; unknown chains rejected. Parse inputs — amount and explicit merchant address (no name-to-address generation). Pre-flight credit checks — SoHo credit layer verifies borrower registration, active status, credit limit. Sign EIP-712 — Wallet Signer (user-controlled) produces signature. SoHo never signs. Submit tx — call spendWithAuthorization on the Creditor contract. Return result — transaction hash + block number.

Supported Networks

NetworkChain IDStatusBase Sepolia84532SupportedBase Mainnet8453Requires SOHO_MAINNET_CONFIRM=YES Unknown chain IDs are rejected at config validation time.

Contract Addresses (Base Sepolia)

ContractAddressCreditor0x1867a19816f38ec31ec3af1be15fd7104f161978Borrower Manager0x76e51158015e869ab2875fa17b87383d8886e93cUSDC (test)0x55b8ff660d4f0f176de84f325d39a773a7a3bda7

Key Custody Boundary

EntityRoleHolds keys?Wallet SignerProduces EIP-712 signaturesYes — user/operator-controlledSoHoCredit authorization + JIT fundingNo — credit layer onlyThis skillOrchestration between the aboveNo — passes typed data to signer SoHo must NEVER custody, hold, generate, or control any signing keys or key shards.

Wallet Signer Providers

ProviderWhen to useRisk levelWALLET_SIGNER_REMOTEProduction / MainnetLow — keys stay in user's MPC/HSM (Turnkey, Privy, Fireblocks, etc.)LOCAL_PRIVATE_KEYDev / Testnet onlyHigh — raw key in env Default and recommended: WALLET_SIGNER_REMOTE. The skill sends EIP-712 typed data to the user's wallet signing service and never touches private keys. Dev-only fallback: LOCAL_PRIVATE_KEY is gated to testnet chain IDs. Using it on mainnet requires DEV_ALLOW_LOCAL_KEY=YES and is strongly discouraged.

Mainnet Safety Gate

Transactions on Base Mainnet (CHAIN_ID=8453) are refused unless SOHO_MAINNET_CONFIRM=YES is set. This prevents accidental mainnet spends during development.

Recipient Address Policy

The skill never derives or generates an address from a merchant name. The merchantAddress argument must be an explicit, valid, checksummed EVM address. Any non-address input is rejected with an error.

Invocation Policy

invocation: manual — the skill cannot be triggered autonomously. require_confirmation: true — the orchestrator must obtain user confirmation before execution. A runtime guard rejects execution if SOHO_AUTONOMOUS=true is detected in the environment.

Threat Model & Mitigations

ThreatMitigationSigner compromiseDefault to WALLET_SIGNER_REMOTE (MPC/HSM); keys never leave the user's signing service. Local key gated to testnet only.Replay attacksRandom 32-byte nonce per transaction; validAfter / expiry window (10 min). On-chain nonce check in Creditor contract.Wrong merchant addressAddress generation from names removed. Only explicit checksummed EVM addresses accepted; checksum validated before signing.Accidental mainnet transactionSOHO_MAINNET_CONFIRM=YES safety gate required for chain ID 8453.Autonomous invocation with signing authorityinvocation: manual in metadata; require_confirmation: true; runtime guard blocks SOHO_AUTONOMOUS=true.SoHo used as signerArchitecture enforces SoHo = credit-only. No signing key env vars reference SoHo as a signer. Skill never passes keys to SoHo API.Undeclared env var dependenciesAll env vars declared in skill.json with types and sensitivity flags.MITM on wallet signer serviceUse HTTPS for WALLET_SIGNER_SERVICE_URL; bearer token auth via SIGNER_SERVICE_AUTH_TOKEN.

Required (all modes)

VariableExampleDescriptionRPC_URLhttps://sepolia.base.orgJSON-RPC endpointCHAIN_ID8453284532 (Sepolia) or 8453 (Mainnet)SIGNER_PROVIDERWALLET_SIGNER_REMOTEWALLET_SIGNER_REMOTE or LOCAL_PRIVATE_KEY

Required for WALLET_SIGNER_REMOTE

VariableDescriptionSensitiveWALLET_SIGNER_SERVICE_URLBase URL of user/operator's wallet signing serviceNoSIGNER_SERVICE_AUTH_TOKENBearer auth token for the wallet signing serviceYes

SoHo Credit Layer

VariableDescriptionSensitiveSOHO_API_URLSoHo credit-layer API (credit checks, JIT funding)No

Required for LOCAL_PRIVATE_KEY (dev / testnet only)

VariableDescriptionSensitiveSOHO_DEV_PRIVATE_KEYUser/operator's raw hex private key (NOT a SoHo key)Yes

Conditional

VariableWhen requiredSOHO_MAINNET_CONFIRMMust be YES when CHAIN_ID=8453DEV_ALLOW_LOCAL_KEYSet YES to allow local key on non-testnet (dangerous)

Dependencies

Install with: npm install PackagePurposeethersEVM interactions, EIP-712 signingdotenvLoad .env fileszodEnv var validation at startup

Category context

Code helpers, APIs, CLIs, browser automation, testing, and developer operations.

Source: Tencent SkillHub

Largest current source with strong distribution and engagement signals.

Package contents

Included in package

3 Config2 Scripts1 Docs

SKILL.md Primary doc
src/pay.js Scripts
src/signer/config.js Scripts
_meta.json Config
package.json Config
skill.json Config