← Back to Skills Marketplace
90
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install skill-alipayplus-integration
Description
Alipay+ Payment Integration Assistant. Helps Acquirers and Mobile Service Providers quickly integrate Alipay+ payments, including customer-presented mode pay...
Usage Guidance
This skill appears to implement legitimate Alipay+ integration helpers, but review before running: 1) Do not run scripts blindly — inspect them line-by-line (they will generate files under $HOME/.openclaw/workspace and may output private keys). 2) The package.json references ./scripts/install.js which is missing; treat the package as incomplete until resolved. 3) The scripts expect environment variables and SSH key files (SFTP_USER, SFTP_KEY, PARTICIPANT_ID, etc.) that are not declared in the skill metadata — do not supply production credentials; use test/sandbox credentials first. 4) test-signature.sh prints private key material to the console and debug-notify.sh logs incoming webhook payloads; avoid pasting real production private keys into generated config files or leaving them readable on disk. 5) If you need to test webhooks, be cautious when using ngrok (it exposes a public URL); limit exposure and rotate any credentials used for testing. 6) Recommended mitigations: run in an isolated environment or VM, create dedicated test keys/accounts, set strict file permissions on any generated files, and remove generated keys/configs after testing. If you want, I can list the exact lines that print or store sensitive values and suggest minimal edits to make the scripts safer before you run them.
Capability Analysis
Type: OpenClaw Skill
Name: skill-alipayplus-integration
Version: 1.0.0
The skill bundle provides tools for Alipay+ payment integration that include high-risk network and file system operations. Specifically, `scripts/debug-notify.sh` utilizes `netcat` (nc) to listen on local ports and `ngrok` for intranet penetration to facilitate webhook debugging, while `scripts/download-reconciliation.sh` is designed to access the user's SSH directory (~/.ssh/alipayplus_sftp) for SFTP-based data retrieval. Although these behaviors are plausibly aligned with the stated purpose of the skill, the inclusion of tools capable of establishing remote access and accessing private keys represents a significant security risk.
Capability Tags
Capability Assessment
Purpose & Capability
Name/description match the included artifacts: config generation, signature testing, webhook debugging, and reconciliation — and the shipped scripts implement those tasks. However, package.json declares a bin entry (./scripts/install.js) and an install script that are not present in the file manifest, and the SKILL metadata declares no required environment variables even though the scripts expect several (SFTP_USER, SFTP_KEY, PARTICIPANT_ID, etc.).
Instruction Scope
SKILL.md instructs the agent to run the provided scripts (generate-config.sh, test-signature.sh, debug-notify.sh, reconciliation.sh). The scripts read/write files under $HOME/.openclaw/workspace and ~/.openclaw, expect SFTP keys, may print private key contents to stdout (test-signature.sh prints the generated private key), and debug-notify.sh can start ngrok to expose a local service and logs incoming requests to a local logfile. The SKILL.md did not declare or surface these file/credential operations explicitly, and some script behaviors (printing private keys, logging incoming webhook content) increase risk if run without review.
Install Mechanism
There is no install spec (instruction-only), which is lower risk, but package.json declares a bin ('alipayplus-install': './scripts/install.js') and an install npm script that refer to scripts/install.js which is missing from the manifest. That mismatch is an integrity/packaging concern — it may be an accidental omission or indicate incomplete/untested packaging.
Credentials
Skill metadata lists no required environment variables or primary credential, but the scripts use multiple environment variables and default paths (SFTP_USER, SFTP_HOST, SFTP_KEY, PARTICIPANT_ID, ENV, LOCAL_DIR, and workspace/private key paths). The scripts also default to user-home locations (e.g., $HOME/.openclaw/workspace, ~/.ssh/alipayplus_sftp) and may read files there. The absence of declared env requirements is an inconsistency; you should not provide production private keys or SFTP credentials until you confirm behavior.
Persistence & Privilege
The skill is not 'always:true' and does not request platform-level persistent privileges. It is user-invocable and allows autonomous invocation (default), which is normal. The skill writes files into its own workspace under the user's home directory, which is expected for this type of tool but should be checked for sensitive data retention.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-alipayplus-integration - After installation, invoke the skill by name or use
/skill-alipayplus-integration - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of Alipay+ Payment Integration Assistant.
- Provides guided assistance for integrating Alipay+ payments, including both customer-presented and merchant-presented modes.
- Features tools for configuration generation, signature verification testing, asynchronous notification debugging (ACQP only), and reconciliation file processing.
- Includes clear boundaries on supported help and referencing of official documentation for detailed API fields and business logic.
- Offers scenario clarification scripts and usage examples for both Acquirer (ACQP) and Mobile Payment Provider (MPP) roles.
- Emphasizes not to guess undocumented details and always refer to official documentation when uncertain.
Metadata
Frequently Asked Questions
What is skill-alipayplus-integration?
Alipay+ Payment Integration Assistant. Helps Acquirers and Mobile Service Providers quickly integrate Alipay+ payments, including customer-presented mode pay... It is an AI Agent Skill for Claude Code / OpenClaw, with 90 downloads so far.
How do I install skill-alipayplus-integration?
Run "/install skill-alipayplus-integration" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is skill-alipayplus-integration free?
Yes, skill-alipayplus-integration is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does skill-alipayplus-integration support?
skill-alipayplus-integration is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created skill-alipayplus-integration?
It is built and maintained by Lizzie (@wypride); the current version is v1.0.0.
More Skills