Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yolfinance/yolfi-agent --skill yolfi-paymentsgit clone --depth 1 https://github.com/yolfinance/yolfi-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yolfinance/yolfi-agent/yolfi-payments)<a href="https://agentmods.dev/skills/yolfinance/yolfi-agent/yolfi-payments"><img src="https://agentmods.dev/badge/skills/yolfinance/yolfi-agent/yolfi-payments/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yolfinance/yolfi-agent/yolfi-payments"><img src="https://agentmods.dev/badge/skills/yolfinance/yolfi-agent/yolfi-payments.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.01028 |
| Opus 5 | $0.00018 | $0.00514 |
| Sonnet 5 | $0.00007 | $0.00206 |
| Haiku 4.5 | $0.00004 | $0.00103 |
Grade A, and why
yolfi-payments scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to yolfi-payments — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Yolfi Payments Skill
Use this when the user asks to add crypto payments, payment links, checkout, subscriptions, donations, or webhook-based entitlements with Yolfi.
Workflow
- Inspect the target app first.
- Identify the framework, env system, server routes, existing checkout code, existing webhook handlers, and entitlement logic.
- Check auth with
yolfi auth:statusoryolfi_auth_status; an explicitYOLFI_API_KEYtakes precedence over the protected local credential. - If auth is missing and the user already has a Yolfi account, use
yolfi setup --agent <slug>followed by browser authorization andyolfi checkin --agent <slug>. The bundled plugin and local MCP server exposeyolfi_agent_setup_startandyolfi_agent_checkin; manually configured remote MCP uses OAuth managed by the host instead. For a new user on the bundled/local transport, first ask them to confirm their email and project name, then callyolfi_agent_register. Ask them to open the emailed confirmation link, then call the same tool again with the same arguments. Existing emails must not be re-registered. The tool stores the credential locally, redacts it from model output, and reuses its pending idempotency key across confirmation check-ins. - Ask the user for settlement wallet addresses. Never invent them.
- Ask the user for product name, price, currency, payment type, and recurring interval.
- Configure settlement settings through
PUT /api/private/organization/current, then create each webhook throughPOST /api/private/organization/webhook-endpoints. The CLI/local MCP stores the one-time signing secret in the protected local Yolfi config and redacts it from output. - List existing paylinks before creating a new one.
- Create or reuse a paylink.
- Store paylink ids in env/config, not hard-coded source when avoidable.
- Add checkout UI or a server route that calls
POST /api/public/payments. Pass a stable merchant-side customer/user id asclientReferenceIdwhenever webhook-driven attribution or subscription lifecycle updates must resolve that customer. - Add webhook signature verification for
X-Yolfi-Signature. In native (NONE) payloads readdata.customer.clientReferenceId; Stripe-compatible Checkout Session usesdata.object.client_reference_id, while Stripe-compatible Invoice and Subscription objects usedata.object.metadata.client_reference_id; Lemon Squeezy-compatible payloads usemeta.custom_data.client_reference_id. - Connect webhook events to the app's existing entitlement/business logic when possible.
- Verify payment status with
GET /api/public/payments/:id. - Report changed files and exact verification commands.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 50 lines · 37 tokens per session scan A e42cf3987596
yolfi-payments is a skill published in the GitHub repository yolfinance/yolfi-agent (188 stars, last pushed 1mo ago), licensed MIT. It adds 37 tokens to every session and 1,028 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to yolfi-payments, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
piprail
Pay x402 paywalled URLs from a budget-bound, self-custodial crypto wallet across 10+ chains.
starknet-mini-pay
Simple P2P payments on Starknet. Generate QR codes, payment links, invoices, and transfer ETH/STRK/USDC. Like Lightning, but native.
starknet-tongo
Confidential ERC20 payments on Starknet using Tongo protocol. Fund, transfer, withdraw, and rollover encrypted token balances with zero-knowledge proofs. Use when the user needs privacy-preserving transactions, confidential payments, encrypted balances, or auditable private transfers on Starknet.
fintech-expert
Expert in financial technology, payment processing, open banking APIs, PSD2, blockchain in finance, robo-advisors, and RegTech. Use when the user mentions payments, open banking, PSD2, blockchain, cryptocurrency, or robo advisor, or when the task involves Payment Processing, Blockchain in Finance, Payment Security, or…
splits
Use Splits with Bankr for onchain treasury operations: secure assets, process revenue, manage operating subaccounts, pay expenses, govern contracts, and maintain clean accounting books.
x402-list
Discover x402 payment services and on-chain-verified facilitator settlement volume via the x402-list directory. Use when a user or agent needs to find an API/service that accepts x402 (HTTP 402 stablecoin) payments, compare services by reliability and price, check service uptime/health, see whether a service has…