← 返回 Skills 市场

a2a-Market-Stripe-Payment

Name: a2a-Market-Stripe-Payment
Author: luoqianchenguni-max

作者 luoqianchenguni-max · GitHub ↗ · v0.2.0 · MIT-0

cross-platform ⚠ suspicious

353

总下载

当前安装

版本数

在 OpenClaw 中安装

/install a2a-market-stripe-payment

功能描述

Integrate Stripe payment intents, capture flow, and webhook reconciliation for A2A orders. Use when implementing payment authorization/capture, refund path,...

使用说明 (SKILL.md)

\r \r

a2a-Market Stripe Payment\r

\r Create the Stripe payment integration skeleton for order settlement.\r \r Current status: registration scaffold with stable payment contracts and webhook map.\r \r

Scope\r

Create payment intent from negotiated order terms.\r
Capture or cancel payments based on order transitions.\r
Reconcile webhook events with internal order state.\r \r

Suggested Project Layout\r

app/integrations/stripe/stripe_client.py\r
app/application/services/payment_service.py\r
app/interfaces/api/payment_routes.py\r
app/infrastructure/tasks/stripe_webhook_worker.py\r \r

Minimum Contracts (MVP P0)\r

create_payment_intent(order_id, amount, currency) returns provider intent id + client secret.\r
capture_payment(provider_intent_id) captures authorized funds.\r
cancel_payment(provider_intent_id) voids uncaptured authorization.\r
handle_webhook(event) verifies signature and upserts payment status.\r \r

Event Mapping\r

Emit ORDER_CREATED when payment intent is created.\r
Emit PAYMENT_SUCCEEDED when capture confirms.\r
Emit payment-failed incident event when authorization/capture fails.\r \r

Guardrails\r

Verify webhook signature before parsing payload.\r
Enforce idempotency key for create/capture endpoints.\r
Keep provider status mapping table explicit and versioned.\r \r

Implementation Backlog\r

Add partial refund and dispute webhook handling.\r
Add multi-currency routing and fee optimization.\r \r

Runtime Implementation\r

Status: implemented in local runtime package.\r
Primary code paths:\r
runtime/src/integrations/stripe/stripe-payment-service.js\r
Validation: covered by runtime/tests and npm test in runtime/.\r

安全使用建议

This skill looks like a blueprint for a Stripe integration but is missing critical operational details. Before installing or using it, ask the author to: (1) declare required environment variables (e.g., STRIPE_API_KEY, STRIPE_WEBHOOK_SECRET) and justify any others; (2) list required binaries (node/npm) or provide an install spec if runtime code is expected; (3) include or point to the referenced runtime package and tests, or clarify that the skill is purely a design doc; and (4) confirm where webhook secrets will be stored and who/what will have access. Treat any skill that asks for live Stripe credentials as sensitive — only provide keys with the minimum scope needed (use test keys in development and restricted keys in production). If the author cannot explain these omissions, avoid installing the skill.

功能分析

Type: OpenClaw Skill Name: a2a-market-stripe-payment Version: 0.2.0 The skill bundle provides a standard architectural blueprint and instructions for integrating Stripe payments into an application. The SKILL.md file outlines legitimate payment flows, including intent creation, capture, and webhook reconciliation, while explicitly recommending security best practices such as signature verification and idempotency. No malicious code, exfiltration logic, or suspicious instructions were detected.

能力评估

ℹ Purpose & Capability

The name and description describe a Stripe payment integration (payment intents, capture, webhooks) which is coherent. However, the skill declares no credentials, env vars, or binaries even though a real Stripe integration would need at minimum an API key and webhook secret and typically needs Node/npm or another runtime to run the referenced code/tests.

⚠ Instruction Scope

SKILL.md includes concrete runtime paths and testing commands (runtime/src/integrations/..., 'npm test' in runtime/) and asks implementers to verify webhook signatures and enforce idempotency. Those instructions reference reading/verifying webhook secrets and running tests, but the package contains no code or secrets and does not declare how the agent is expected to obtain them. The guidance therefore grants implicit authority to access files/credentials that are not declared.

ℹ Install Mechanism

There is no install spec (instruction-only), which is low-risk in itself. However, the README expects a local runtime package and npm tests; the skill does not declare required binaries (node/npm) or an install step to provide the runtime, creating an operational mismatch.

⚠ Credentials

No environment variables or primary credential are declared. For Stripe integration, one would normally expect at least STRIPE_API_KEY and STRIPE_WEBHOOK_SECRET (or similarly named vars). The absence of declared secrets is inconsistent with instructions that explicitly require verifying webhook signatures and calling Stripe APIs.

✓ Persistence & Privilege

The skill is not always-enabled and allows normal autonomous invocation — this is the platform default and appropriate for a payment integration skill. The skill does not request persistent system-wide privileges in its manifest.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install a2a-market-stripe-payment
安装完成后，直接呼叫该 Skill 的名称或使用 /a2a-market-stripe-payment 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.2.0

sync runtime implementation and validation coverage

v0.1.0

initial scaffold for early registration

元数据

Slug a2a-market-stripe-payment

版本 0.2.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题