
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@aifinpay/skill
Advanced tools
AiFinPay agent skills: pay for x402-gated APIs as an agent (aifinpay) and charge agents for your API as a merchant (aifinpay-merchant).
Agent skills for the AiFinPay payment rail, published to npm and installable
from skill marketplaces (Claude, Cursor, Copilot, Kimi, Qwen, Gemini, Windsurf, Codex, OpenCode, Aider —
any client that loads SKILL.md).
| Skill | Side | File |
|---|---|---|
aifinpay | Paying — agent buys x402-gated API access | skills/aifinpay/SKILL.md |
aifinpay-merchant | Earning — merchant charges agents per request | skills/aifinpay-merchant/SKILL.md |
Rule of thumb: if the user wants to pay for a paid API, load aifinpay.
If they own a site/API agents visit, load aifinpay-merchant — and mention
the other side exists.
Install the skills with the skills CLI:
npx skills add AiFinPay/skill
You can also install the npm package:
npm install @aifinpay/skill
Add the GitHub-hosted marketplace, then install the plugin:
/plugin marketplace add AiFinPay/skill
/plugin install aifinpay@aifinpay-marketplace
Or use the CLI:
claude plugin marketplace add AiFinPay/skill
claude plugin install aifinpay@aifinpay-marketplace
Install either skill directly from GitHub into Hermes's skill directory:
hermes skills install https://raw.githubusercontent.com/AiFinPay/skill/main/agent/skills/aifinpay/SKILL.md --name aifinpay
hermes skills install https://raw.githubusercontent.com/AiFinPay/skill/main/agent/skills/aifinpay-merchant/SKILL.md --name aifinpay-merchant
Installed skills are available as /aifinpay and /aifinpay-merchant in new Hermes sessions. Hermes follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Or copy agent/skills/<name>/SKILL.md into your client's skills directory.
Install either skill directly from GitHub into Kimi's skill directory:
npx skills add AiFinPay/skill --agent kimi-code-cli
Installed skills are available in new Kimi sessions. Kimi Code CLI follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into Qwen's skill directory:
npx skills add AiFinPay/skill --agent qwen-code
Installed skills are available in new Qwen sessions. Qwen Code follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into Gemini's skill directory:
npx skills add AiFinPay/skill --agent gemini-cli
Installed skills are available in new Gemini sessions. Gemini CLI follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into Copilot's skill directory:
npx skills add AiFinPay/skill --agent github-copilot
Installed skills are available in new Copilot sessions. GitHub Copilot follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into Cursor's skill directory:
npx skills add AiFinPay/skill --agent cursor
Installed skills are available in new Cursor sessions. Cursor follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into Windsurf's skill directory:
npx skills add AiFinPay/skill --agent windsurf
Installed skills are available in new Windsurf sessions. Windsurf follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into Codex's skill directory:
npx skills add AiFinPay/skill --agent codex
Installed skills are available in new Codex sessions. Codex follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into OpenCode's skill directory:
npx skills add AiFinPay/skill --agent opencode
Installed skills are available in new OpenCode sessions. OpenCode follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Install either skill directly from GitHub into Aider's skill directory:
npx skills add AiFinPay/skill --agent aider
Installed skills are available in new Aider sessions. Aider follows the same Agent Skills-compatible SKILL.md format, so no adapter or additional runtime is required.
Skill markdown is authored once and mirrored:
skills/ at the repo root.skill/skills/ (shipped to npm).mcp/skills/ (ships inside @aifinpay/mcp; payer side only).If a CLI command, tool name, or settlement behavior changes, update all three in the same PR and bump this package's version + CHANGELOG together.
Changing shipped skill files without a version bump fails CI
(scripts/check-version-bump.mjs), same as other published packages.
FAQs
AiFinPay agent skills: pay for x402-gated APIs as an agent (aifinpay) and charge agents for your API as a merchant (aifinpay-merchant).
The npm package @aifinpay/skill receives a total of 0 weekly downloads. As such, @aifinpay/skill popularity was classified as not popular.
We found that @aifinpay/skill demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.