← Back to Skills Marketplace
luoqianchenguni-max

a2a supermarket

by luoqianchenguni-max · GitHub ↗ · v0.2.2 · MIT-0
cross-platform ✓ Security Clean
259
Downloads
0
Stars
0
Active Installs
4
Versions
Install in OpenClaw
/install a2a-supermarket
Description
Unified entry skill for RealMarket A2A commerce workflows. Supports seller product publish and buyer product discovery through UCP market connectivity, plus...
README (SKILL.md)

a2a-supermarket

Act as the integrated entrypoint for the A2A market runtime.

Current status: orchestrator scaffold for early launch. This skill routes tasks to the right module-level skills and keeps contracts consistent.

Direct Marketplace Actions (Implemented)

This skill now supports two direct role-based actions:

  1. Seller publishes products to market (role=seller).
  2. Buyer discovers products from market (role=buyer).

Executable Entrypoint

Run from skill directory:

node src/cli/index.js --role seller --domain 127.0.0.1:3456 --name "Skill Chair" --price-minor-units 12999 --category Furniture
node src/cli/index.js --role buyer --domain 127.0.0.1:3456 --query chair --limit 10
node src/cli/index.js --role buyer --domain 127.0.0.1:3456 --all true

The CLI also accepts stdin JSON with the same fields. Output is JSON only:

  • seller: publish result (mode=seller_publish)
  • buyer: discovery result (mode=buyer_discover, supports all/listAll for full listing)

Routing Map

  • Identity and login: route to a2a-market-google-oauth.
  • Intent broadcast and node response: route to a2a-market-ucp-broadcast.
  • Stake lock and penalty policy: route to a2a-market-stake-freeze.
  • Multi-round negotiation: route to a2a-market-acp-lite-negotiation.
  • Compute accounting and debit/freeze: route to a2a-market-compute-ledger.
  • Payment authorization and capture: route to a2a-market-stripe-payment.
  • Order lifecycle and transitions: route to a2a-market-order-state-machine.
  • Realtime event fanout: route to a2a-market-websocket-realtime.

End-to-End Flow (MVP)

  1. Authenticate actor and create session.
  2. Build buyer intent and broadcast via UCP.
  3. Collect quotes and start ACP-lite negotiation.
  4. Freeze stake and reserve compute budget before commit.
  5. Create order and payment intent.
  6. Capture payment after final acceptance.
  7. Transition order through fulfillment to completion.
  8. Emit events to websocket, billing, reputation, and logs.

Canonical Event Backbone

  • INTENT_CREATED
  • INTENT_BROADCASTED
  • NODE_RESPONDED
  • QUOTE_RECEIVED
  • NEGOTIATION_STARTED
  • RISK_FLAGGED
  • ORDER_CREATED
  • PAYMENT_SUCCEEDED
  • ORDER_COMPLETED
  • REPUTATION_UPDATED

Interface Contracts

  • Keep request and event payloads versioned.
  • Enforce idempotency keys on write operations.
  • Use deterministic timestamps and correlation ids.
  • Propagate a single trace_id across all modules.

Coordination Rules

  • Prefer module skill execution for domain-specific logic.
  • Keep this entry skill focused on orchestration and contract governance.
  • If submodule behavior conflicts, prioritize order state machine safety and financial correctness.

Implementation Backlog

  • Add global policy engine for cross-module risk checks.
  • Add replay/debug mode for full transaction traces.
  • Add SLA dashboard hooks for timeouts and retries.

Runtime Implementation

  • Status: implemented in local runtime package.
  • Primary code paths:
  • runtime/src/application/market-agent.js
  • runtime/src/cli/index.js
  • runtime/tests/market-agent.e2e.test.js
  • a2a-supermarket/src/cli/index.js
  • Validation: covered by runtime/tests and npm test in runtime/.
Usage Guidance
This skill appears to do what it claims: it discovers a UCP profile at the provided domain and then GETs/POSTs product data to the discovered REST endpoint. Before installing or invoking it: 1) only point it at domains you trust — it will make outbound HTTP(S) requests and can POST product payloads to the discovered endpoint; 2) be aware SKILL.md mentions external modules (OAuth, Stripe, ledgers) that are not bundled here — full end-to-end flows may require additional skills/credentials later; 3) the code is small and inspectable, but run it in a sandbox or test environment first if the domain is untrusted; and 4) ensure your Node runtime supports global fetch or provide a polyfill when running the CLI.
Capability Analysis
Type: OpenClaw Skill Name: a2a-supermarket Version: 0.2.2 The skill acts as a legitimate orchestration entry point for a commerce workflow, allowing users to publish or discover products via a marketplace API. The implementation in `src/cli/index.js` is a standard Node.js CLI that uses the `fetch` API to interact with user-provided domains and follows the Unified Commerce Protocol (UCP) for service discovery. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.
Capability Assessment
Purpose & Capability
The CLI implements buyer discovery and seller publish by discovering a UCP profile at /.well-known/ucp and calling discovered REST endpoints; this matches the skill name/description. The SKILL.md mentions orchestration and routing to other module skills (Google OAuth, Stripe, ledger, etc.), but those modules are not bundled here — that's plausible for an orchestrator scaffold.
Instruction Scope
Runtime instructions and included code only read stdin/CLI flags and perform HTTP(S) requests to the provided domain's well-known UCP path and REST endpoints. The skill does not read local credential files, environment variables, or unrelated system paths. Its network activity (discovering profile and POST/GET to discovered endpoints) is expected for the stated functionality.
Install Mechanism
No install spec is provided (instruction-only with a small Node CLI file). Nothing is downloaded or installed by the skill bundle, so no install-time code injection concerns are present.
Credentials
The skill declares no required environment variables or credentials, which is consistent with the included code. The SKILL.md references integrations that in full deployments would require credentials (OAuth, Stripe), but those are external modules not present here; this skill itself does not request secrets.
Persistence & Privilege
The skill does not request persistent presence (always is false) and does not modify other skills' configuration or system-wide settings. It runs as an on-demand CLI/orchestrator and has no elevated platform privileges.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install a2a-supermarket
  3. After installation, invoke the skill by name or use /a2a-supermarket
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.2
remove UTF-8 BOM from SKILL.md so OpenClaw can load skill
v0.2.1
add buyer full-list discovery and docs updates
v0.2.0
sync runtime implementation and validation coverage
v0.1.0
create canonical slug a2a-supermarket
Metadata
Slug a2a-supermarket
Version 0.2.2
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 4
Frequently Asked Questions

What is a2a supermarket?

Unified entry skill for RealMarket A2A commerce workflows. Supports seller product publish and buyer product discovery through UCP market connectivity, plus... It is an AI Agent Skill for Claude Code / OpenClaw, with 259 downloads so far.

How do I install a2a supermarket?

Run "/install a2a-supermarket" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is a2a supermarket free?

Yes, a2a supermarket is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does a2a supermarket support?

a2a supermarket is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created a2a supermarket?

It is built and maintained by luoqianchenguni-max (@luoqianchenguni-max); the current version is v0.2.2.

💬 Comments