kash

# Kash Payment Skill

This skill gives your OpenClaw agent access to a Kash wallet so it can pay for external services autonomously, within your configured budget.

## Security model

- `KASH_KEY` and `KASH_AGENT_ID` are required. The skill will fail at load time if either is missing — it will not silently proceed.
- `KASH_API_URL` is validated against an allowlist (api.kash.dev and localhost only) at startup. Setting it to any other domain is rejected immediately to prevent `KASH_KEY` from being sent to an untrusted server.
- `KASH_BUDGET` is enforced locally in code as a session cap. It is not just a guideline — the spend function checks it before every call.
- Spends above `KASH_SPEND_CONFIRMATION_THRESHOLD` ($5.00 default) require `confirmed=true`, which the agent must only set after receiving an explicit YES from the user in the current conversation.
- Budget enforcement happens at two layers: locally (KASH_BUDGET) and server-side (Kash dashboard budget). Both must pass. The server is the authoritative source of truth.

## Tools provided

### kash_spend

Spend from the Kash agent wallet before making a paid API call.

Parameters:
- `amount` (number, required) — amount in USD
- `description` (string, required) — what you are paying for
- `merchant` (string, optional) — name of the service
- `confirmed` (boolean, optional) — set true only after explicit user YES for spends above threshold

Return values:
- `OK. Spent $X for "..."` — spend succeeded
- `CONFIRMATION_REQUIRED: ...` — ask user for YES, then retry with confirmed=true
- `LOCAL_BUDGET_EXCEEDED: ...` — session cap hit, stop and notify user
- `BUDGET_EXCEEDED: ...` — server-side budget hit, stop and notify user
- `AGENT_PAUSED: ...` — agent paused by user in Kash dashboard
- `UNAUTHORIZED: ...` — KASH_KEY invalid or expired
- `ERROR: ...` — unexpected failure

### kash_balance

Check remaining budget without spending. Returns both server-side balance and local session cap.

## When to use this skill

Use...