Skills altllm-portal-payments
๐Ÿ“ฆ

altllm-portal-payments

Content revision r1 High Risk ๐ŸŒ Network access๐Ÿ”‘ Env variablesโš™๏ธ External commands๐Ÿ“ Filesystem access

Create AltLLM Crypto Payment Links

AltLLM Portal payment work can require several CLI flags and status checks. This skill guides hosted links, discounted links, polling, and guarded direct wallet payments.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "altllm-portal-payments" from https://skillstore.io/skills/internet-court-altllm-portal-payments.md and its manifest at https://skillstore.io/api/skills/internet-court-altllm-portal-payments/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "altllm-portal-payments". Create a hosted payment link for 25 USD.

Expected outcome:

The assistant prepares the topup-crypto command, confirms the target Portal endpoint, and returns the hosted checkout link.

Using "altllm-portal-payments". Check whether payment link pl_123 has settled.

Expected outcome:

The assistant polls the payment status, reports the current state, and explains whether the link can still be paid.

Using "altllm-portal-payments". Pay an existing usdcbase payment link from my configured wallet key.

Expected outcome:

The assistant verifies the link is not terminal, confirms payment details, and runs the guarded direct payment flow.

Security Audit

High Risk
v2 โ€ข 7/21/2026 Open versioned report

Most static findings are Markdown-formatting false positives, including command-name backticks, repository-relative reference paths, payment-link identifiers, and the documented Portal endpoint. The skill genuinely handles wallet private keys and can initiate direct on-chain payments, creating a high-impact financial and credential-handling risk that requires explicit user confirmation.

2
Files scanned
125
Lines analyzed
5
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Irreversible Direct Wallet Payment Capability
The skill documents a command that sends a direct on-chain payment for an existing payment link. A mistaken or malicious payment-link identifier can cause an irreversible transfer when a wallet private key is supplied.
The command index explicitly states that pay-payment-link sends a direct on-chain payment, and the reference shows it accepting a private key. Blockchain transfers generally cannot be reversed.
Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Generic API/secret keys
ALTLLM_WALLET_PRIVATE_KEY=<private-key> \
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
High
Generic API/secret keys
--private-key-env ALTLLM_WALLET_PRIVATE_KEY \
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
High
Generic API/secret keys
ALTLLM_WALLET_PRIVATE_KEY=<private-key> \
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
High
Generic API/secret keys
--private-key-env ALTLLM_WALLET_PRIVATE_KEY \
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
High
Generic API/secret keys
- `ALTLLM_WALLET_PRIVATE_KEY=<private-key>` with the default `--private-key-env ALTLLM_WALLET_PRIVAT
The workflow accepts a wallet private key through an environment variable for direct on-chain payments. Exposure or misuse of this credential can authorize transfers from the wallet.
Audited by: claude View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-altllm-portal-payments/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-altllm-portal-payments/security.svg)](https://skillstore.io/skills/internet-court-altllm-portal-payments?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-altllm-portal-payments?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-altllm-portal-payments/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-altllm-portal-payments.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

internet-court. (2026). altllm-portal-payments security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-altllm-portal-payments/audits/2

BibTeX citation

@techreport{internet-court-internet-court-altllm-portal-payments-2026, author = {internet-court}, title = {altllm-portal-payments security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-altllm-portal-payments/audits/2}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "altllm-portal-payments security audit report (audit version 2)" version: "unspecified" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-altllm-portal-payments/audits/2" identifiers: - type: other value: "skillstore:internet-court-altllm-portal-payments:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
41
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Create Hosted Payment Links

Generate a NOWPayments link for a customer or internal account payment without direct wallet signing.

Verify Settlement Progress

Poll a payment-link ID and review whether it is pending, completed, expired, failed, or deactivated.

Test Direct Token Payments

Run guarded direct payment flows for supported EVM tokens during Portal billing validation.

Try These Prompts

Create a Hosted Link
Create a hosted AltLLM Portal crypto payment link for 25 USD. Show the command you will run before executing it.
Check Payment Status
Check the status of payment link ID <id> and wait for a final state if the CLI supports it.
Create a Discounted Link
Create a discounted payment link for 100 USD with discount code SOLANA and pay currency sol. Confirm the selected token first.
Run Direct Wallet Payment
Prepare a direct usdcbase payment for payment link ID <id>. Confirm amount, token, destination, and terminal status before paying.

Best Practices

  • Confirm amount, token, payment-link ID, and base URL before creating or paying a link.
  • Use protected environment or file-based key input instead of raw private-key command arguments.
  • Check terminal payment states and supported currencies before enabling direct payment.

Avoid

  • Using NOWPayments payment links for x402 quote and settle workflows.
  • Paying completed, expired, failed, or deactivated payment links.
  • Passing wallet private keys through command arguments or storing them in chat logs.

Frequently Asked Questions

Does this skill create x402 credit top-ups?
No. It covers NOWPayments payment links. Use the separate x402 workflow for quote and settle credit top-ups.
Can it pay a link directly from a wallet?
Yes, for supported currencies, after the user confirms the payment details and provides a safe private-key input path.
Which direct-payment currencies are supported?
The documented currencies are eth, usdterc20, usdcerc20, usdcbase, and usdtbase.
Can it inspect older payment links?
Not reliably. The documented CLI flows search only the newest 100 Portal payment links.
Should private keys be passed as command arguments?
No. Use environment or protected file input because command arguments can leak through shell history and process listings.
Does this skill manage Portal API keys?
No. It is not intended for wallet login, API key management, billing history, or subscription workflows.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/21/2026

Usage

1 downloads ยท 0 views

File structure

๐Ÿ“ references/

๐Ÿ“„ cli-reference.md

๐Ÿ“„ SKILL.md