agents-pay

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: ai, cloud, payments, security, validation.

What it does

Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits. Covers payment setup, policy, session budgets, and troubleshooting. Triggers on: "my agent hit a 402 while calling an API", "a tool call returned 402 Payment Required", "my agent needs to pay for x402-protected content", "let the agent pay for content, capped at $5 per session", "set a spend limit for the agent", "ProcessPayment failed", or "why did my agent refuse to pay". Not for BUILDING payment capability for end users, including wallets and framework middleware; use agents-build and references/payments.md. For non-paid APIs via Gateway use agents-connect. For inbound auth use agents-harden. For project scaffolding use agents-get-started.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill agents-pay

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents/skills/agents-pay ~/.claude/skills/agents-pay

Safety box score

Grade F, high risk: 74 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill can fetch x402-protected content from the public web and settle payments through AWS AgentCore at runtime. The main risks are autonomous spending, outbound network reach, and the setup path touching provider credentials and plaintext secret files; a few core enforcement files were not readable here, which limits audit confidence.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs local scripts and subprocesses (`python3 scripts/x402_fetch_cli.py`, `spawn(pythonPath, [bridgePath], ...)`, `subprocess.run(...)`), but I did not see raw `eval` or shell pipelines in the runtime path.
Network access	3 (high)	Outbound network access is core to the skill: it fetches arbitrary HTTPS merchant URLs and talks to AWS AgentCore (`probeUrl`, `replayWithHeader`, `bedrock-agentcore` bridge).
Filesystem reach	2 (moderate)	It reads and writes user-home config and dotfiles (`~/.agents-pay/config.json`, `~/.x402/config.json`, `agentcore/.env.local`), but I did not see broad system-path writes or recursive deletes in the main flow.
Secrets & credentials	3 (high)	The setup explicitly handles provider credentials and plaintext secret storage (`agentcore/.env.local`, wallet/provider secrets, session IDs), so it touches sensitive material directly.
Privilege & persistence	2 (moderate)	It requires global installs and AgentCore deployment (`npm install -g @aws/agentcore`, `agentcore deploy`) plus IAM-role separation, but I saw no sudo or service-registration step.
Instruction hijack surface	1 (low)	The docs contain strong behavioral directives, but I did not find hidden text or remote instruction fetching; the main injection exposure is the optional raw-body return setting.
Irreversible actions	3 (high)	The runtime can autonomously spend approved session budget on 402 responses and return a paid replay (`get_paid_content`, `x402_fetch`), which is the skill's purpose.
Transparency	2 (moderate)	Several core files could not be read here (`scripts/x402_policy.py`, `scripts/x402_fetch.py`, `scripts/agents_pay_admin.py`, `scripts/test_x402_policy.py`), so the strongest enforcement logic could not be fully audited.

Before installing

Read `scripts/x402_policy.py`, `scripts/x402_fetch.py`, and `scripts/agents_pay_admin.py` locally or ask the maintainer for a full audit; they were not readable here.
Run it first in a scratch AWS account/testnet session with `returnBody` unset and confirm `ProcessPaymentRole` lacks `CreatePaymentSession`.
Check that `~/.agents-pay/config.json` and `~/.x402/config.json` are mode `0600` and owned by your account before the agent runs.
Verify `agentcore/.env.local` is gitignored and contains no real provider secrets before provisioning.

Rated 2026-10-15 by an automated review of 26 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents/skills/agents-pay/SKILL.md
Branch: main
Collection: aws-agents
Updated: 2026-09-19

agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.
aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.
pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.
scanning-with-aws-security-agent — Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked.
amazon-bedrock — Builds generative AI applications on Amazon Bedrock.