Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ccxt/ccxt/payment-assistantnpx skills add ccxt/ccxt --skill payment-assistantgit clone --depth 1 https://github.com/ccxt/ccxtWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00119 | $0.07507 |
| Opus 5 | $0.00060 | $0.03753 |
| Sonnet 5 | $0.00024 | $0.01501 |
| Haiku 4.5 | $0.00012 | $0.00751 |
Grade A, and why
payment-assistant scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 825 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ CRITICAL: How to Handle QR Images
When user sends a QR code image or asks to pay:
Step 0: Check if user provided a PAYMENT LINK (text, not an image)
If the user provided text (not an image), and the text is a URL containing
app.binance.com/uni-qr/ or app.binance.com/qr/:
→ This is a payment link. Skip all decode steps. Go directly to purchase:
python3 payment_skill.py --action purchase --raw_qr "<the URL text>"
Otherwise (user sent an image, or text doesn't match above) → continue to Step 1.
Step 1: Try to READ the QR data directly (Vision)
Look at the QR code image and try to extract the actual data string (URL or EMV code).
- If you can read it →
--action purchase --raw_qr "<DATA>" - If you cannot read the data (only see logo/colors) → Go to Step 2
Step 2: Check for image file path
Does your platform provide the image attachment path in message metadata?
- If YES →
--action decode_qr --image "<PATH>" - If NO → Go to Step 3
Step 3: Ask user for help (DO NOT auto-use clipboard!)
"I cannot read the QR directly. Please copy to clipboard, then reply 'use clipboard'"
(Translate to user's language as needed)
Step 4: Only after user confirms → use clipboard
python3 payment_skill.py --action decode_qr --clipboard
⛔ FORBIDDEN:
- ❌
--clipboardwithout user explicitly saying "use clipboard" - ❌ Guessing or searching for image files
- ❌ Skipping the "ask user" step
✅ REQUIRED after decode_qr succeeds:
- Tell user the image source (e.g., "Decoded from clipboard" or "Decoded from file: xxx.jpg")
- Include
source_typefrom response in your message to user
🚀 Quick Start - Agent MUST Execute
When user sends a QR code image or asks to pay:
Step 1 - Get QR Data (Choose ONE method)
Method A: AI Vision (BEST - if your platform supports it)
1. Use your vision capability to read the QR code content directly from the image
2. Skip decode_qr entirely, go straight to purchase with the QR data
python3 payment_skill.py --action purchase --raw_qr "https://app.binance.com/uni-qr/xxx"
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- common.py 22 KB runs code
- payment_skill.py 2.8 KB runs code
- receive.py 3.8 KB runs code
- references/setup-guide.md 1.8 KB
- requirements.txt 37 B
- send_extension/__init__.py 1.3 KB runs code
- send_extension/base.py 1.6 KB runs code
- send_extension/c2c.py 8.4 KB runs code
- send_extension/pix.py 13 KB runs code
- send.py 38 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 825 lines · 119 tokens per session scan A d45a3ed5017b
payment-assistant is a skill published in the GitHub repository ccxt/ccxt (43,833 stars, last pushed today), licensed MIT. It adds 119 tokens to every session and 7,507 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
add-data-sources
Prompts to integrate 70+ new crypto data sources into free-crypto-news, wiring them through the ProviderChain framework with circuit breakers, anomaly detection, and consensus. Covers market data, on-chain analytics, DeFi, derivatives, social, news, Solana ecosystem, L2s, NFTs, prediction markets, RWA, MEV, and more.
scale-to-1m
Step-by-step prompts to prepare free-crypto-news for 1M+ concurrent users. Covers database, job queues, WebSocket scaling, CDN caching, observability, load testing, DDoS protection, graceful degradation, API gateway, multi-region deployment, and disaster recovery.
scale-to-million
Comprehensive scaling checklist and action plan to prepare free-crypto-news for 1M+ concurrent users. Use when planning infrastructure upgrades, load testing, or pre-launch scaling sprints. Covers caching, databases, queues, CDN, horizontal scaling, and observability.
add-data-source
Step-by-step guide for adding a new data source provider to the free-crypto-news platform. Covers the full lifecycle from API evaluation to adapter implementation, testing, and registration. Use when integrating a new market data, on-chain, social, or news source.
competitive-moat
Strategic analysis skill for benchmarking free-crypto-news against CoinGecko, DefiLlama, CoinMarketCap, and other crypto data platforms. Identifies differentiation opportunities and growth strategies for reaching 1M+ users.
historical-trend-analysis
Analyze historical cryptocurrency news patterns, market narratives, and past cycle behavior using the free-crypto-news archive to identify recurring patterns, validate current theses, and provide context for current market conditions. Use when the user wants to understand how crypto history might rhyme with today.