Payment Skill

AI 原生支付解决方案 - 提供安全、可靠的支付功能

This package contains working payment-client code, but there are several inconsistencies and configuration choices you should check before installing: - Verify the correct API endpoint and owner: files disagree (api.zlclaw.com vs api.alipay.com) and ownerId values differ. Confirm which remote service you will talk to and that you trust that service and owner. - Confirm required environment variables: SKILL.md, _meta.json, and YAML disagree about whether PAYMENT_API_URL is required. Ensure you understand which env vars must be set and where secrets (PAYMENT_API_SECRET) will be stored. - Check logging configuration and file paths: production config mentions /var/log/payment-skill; decide whether logs will contain sensitive data and whether the skill should be allowed to write there. Prefer giving the skill a confined writable path. - Encryption behavior: encryption is optional but DataEncryption.from_env requires a 32-byte PAYMENT_ENCRYPTION_KEY if used. Confirm how the skill uses that key and where it is stored. - Run in an isolated environment first: install into an isolated VM/container or dedicated venv, review network calls (to the configured API_URL), and test with non-production credentials. - Inspect pinned dependencies: requirements are pinned and include cryptography/pycryptodome; consider updating to supported versions if needed and scan dependencies for vulnerabilities. - Source provenance: there is a GitHub issues link and an email in SKILL.md, but registry source/homepage are missing. If you need assurance, ask the maintainer for the canonical repository and verify the commit history and owner before trusting production credentials to this skill. If you cannot verify the endpoint, owner, and configuration, treat this skill as risky for production use (use test credentials in an isolated environment until you can confirm).

Type: OpenClaw Skill Name: payment-skill Version: 1.0.3 The payment-skill bundle is a well-structured implementation of a payment processing service. It follows security best practices, including HMAC-SHA256 request signing in `payment_api_client.py`, input sanitization in `security.py`, and sensitive data masking in `diagnose.py` and `utils.py`. The code logic is consistent with the stated purpose in `SKILL.md`, and no evidence of data exfiltration, malicious execution, or prompt injection was found.