Circlefin Official Buy Crypto

Name: Circlefin Official Buy Crypto
Author: circlefin

Payments by @circlefin v1.0.0 B PASS 4 flags

Set up and integrate Circle Onramp, the hosted widget that lets end users buy crypto with fiat (bank transfer, debit card, Apple Pay, Google Pay) delivered to their wallet, using App Kit (`@circle-fin/app-kit`, `kit.onramp`) or the standalone Onramp Kit (`@circle-fin/onramp-kit`). Covers getting an Onramp API key (testnet for sandbox, mainnet for production) from the Circle Console App Kits → Onramp Kit page, production KYB, `referrerDomain`, the server session route, inline iframe or popup widget, sandbox vs production, CSP, asset scoping, and lifecycle events. Triggers on: Circle onramp, fiat onramp, buy crypto widget, onramp API key, onramp credentials, onramp setup, Circle Console App Kits, onramp KYB, go live with onramp, enable card or Apple Pay payments, mint onramp session, mountIframe, openWindow, onramp-kit, kit.onramp.

Install

$ cp -r cryptoskill/skills/payments/circlefin-official-buy-crypto .claude/skills/

$ clawhub install circlefin-official-buy-crypto

Quality Score

Score: 71/100 Grade: B Risk Gate: PASS

Trust profile trust grade not computed yet

4 red flags 6 cleared 1 not measured

Capabilities below are detected automatically by an open-source scanner that reads the skill's text and scripts (see how this is computed). Not measured means the scanner couldn't make a confident call — it is NOT a green check, and you should treat it as a possible red flag until a human or a stronger scanner has measured it.

4 Red flags things this skill can do that affect your security or funds

⚠
Requires hosted operator depends on a third-party hosted service to function
⚠
Mutable remote runtime runs remote code that can change behavior without a local diff
⚠
Can install code installs software at setup time (npx, pip, brew, etc.)
⚠
Can execute shell runs arbitrary shell commands on your machine

6 Cleared by scanner we scanned the skill's text & scripts and found no evidence of these

✓
Can move funds this skill can sign and send transactions on your behalf
✓
Requires private key you must hand over a private key, mnemonic, or wallet config
✓
Uses remote install script setup pipes a remote shell script (curl | sh class)
✓
Can browse the web fetches arbitrary URLs at runtime
✓
Can write files writes to your local filesystem
✓
Can spawn sub-agents delegates to other skills or sub-agents

1 Not measured yet scanner couldn't make a confident call — treat as a possible red flag

?
Auto-invocable may be invoked by the agent without your explicit prompt

Execution mode

analysis_only Phase 1 single-mode classification — multi-mode breakdown deferred to Phase 2.

Ingredients (services this skill talks to)

External services this skill needs in order to work. The skill's behavior depends on these services being up, honest, and unchanged. Today we only show services we recognize from a curated list of ~50 well-known hosts (exchanges, RPC providers, data APIs); a complete dependency list — including every package, library, and binary the skill installs or imports — is on the roadmap.

service circle.com

Audits

No one has audited this skill yet. That is different from “audited and clean” — it just means no professional reviewer (a security firm, the CryptoSkill team, or a verified independent researcher) has signed off on it. There are no audit reports to read. How reviewer levels work →

SKILL.md → SOURCE.md → TRUST.auto.yaml → Browse directory →

Auto-generated by cryptoskill/extract-capabilities/0.3.1 · hosted-service list version 2026-09-06 · how this is computed

Source

View on GitHub →