← 返回 Skills 市场
luoqianchenguni-max

a2a supermarket

作者 luoqianchenguni-max · GitHub ↗ · v0.2.2 · MIT-0
cross-platform ✓ 安全检测通过
259
总下载
0
收藏
0
当前安装
4
版本数
在 OpenClaw 中安装
/install a2a-supermarket
功能描述
Unified entry skill for RealMarket A2A commerce workflows. Supports seller product publish and buyer product discovery through UCP market connectivity, plus...
使用说明 (SKILL.md)

a2a-supermarket

Act as the integrated entrypoint for the A2A market runtime.

Current status: orchestrator scaffold for early launch. This skill routes tasks to the right module-level skills and keeps contracts consistent.

Direct Marketplace Actions (Implemented)

This skill now supports two direct role-based actions:

  1. Seller publishes products to market (role=seller).
  2. Buyer discovers products from market (role=buyer).

Executable Entrypoint

Run from skill directory:

node src/cli/index.js --role seller --domain 127.0.0.1:3456 --name "Skill Chair" --price-minor-units 12999 --category Furniture
node src/cli/index.js --role buyer --domain 127.0.0.1:3456 --query chair --limit 10
node src/cli/index.js --role buyer --domain 127.0.0.1:3456 --all true

The CLI also accepts stdin JSON with the same fields. Output is JSON only:

  • seller: publish result (mode=seller_publish)
  • buyer: discovery result (mode=buyer_discover, supports all/listAll for full listing)

Routing Map

  • Identity and login: route to a2a-market-google-oauth.
  • Intent broadcast and node response: route to a2a-market-ucp-broadcast.
  • Stake lock and penalty policy: route to a2a-market-stake-freeze.
  • Multi-round negotiation: route to a2a-market-acp-lite-negotiation.
  • Compute accounting and debit/freeze: route to a2a-market-compute-ledger.
  • Payment authorization and capture: route to a2a-market-stripe-payment.
  • Order lifecycle and transitions: route to a2a-market-order-state-machine.
  • Realtime event fanout: route to a2a-market-websocket-realtime.

End-to-End Flow (MVP)

  1. Authenticate actor and create session.
  2. Build buyer intent and broadcast via UCP.
  3. Collect quotes and start ACP-lite negotiation.
  4. Freeze stake and reserve compute budget before commit.
  5. Create order and payment intent.
  6. Capture payment after final acceptance.
  7. Transition order through fulfillment to completion.
  8. Emit events to websocket, billing, reputation, and logs.

Canonical Event Backbone

  • INTENT_CREATED
  • INTENT_BROADCASTED
  • NODE_RESPONDED
  • QUOTE_RECEIVED
  • NEGOTIATION_STARTED
  • RISK_FLAGGED
  • ORDER_CREATED
  • PAYMENT_SUCCEEDED
  • ORDER_COMPLETED
  • REPUTATION_UPDATED

Interface Contracts

  • Keep request and event payloads versioned.
  • Enforce idempotency keys on write operations.
  • Use deterministic timestamps and correlation ids.
  • Propagate a single trace_id across all modules.

Coordination Rules

  • Prefer module skill execution for domain-specific logic.
  • Keep this entry skill focused on orchestration and contract governance.
  • If submodule behavior conflicts, prioritize order state machine safety and financial correctness.

Implementation Backlog

  • Add global policy engine for cross-module risk checks.
  • Add replay/debug mode for full transaction traces.
  • Add SLA dashboard hooks for timeouts and retries.

Runtime Implementation

  • Status: implemented in local runtime package.
  • Primary code paths:
  • runtime/src/application/market-agent.js
  • runtime/src/cli/index.js
  • runtime/tests/market-agent.e2e.test.js
  • a2a-supermarket/src/cli/index.js
  • Validation: covered by runtime/tests and npm test in runtime/.
安全使用建议
This skill appears to do what it claims: it discovers a UCP profile at the provided domain and then GETs/POSTs product data to the discovered REST endpoint. Before installing or invoking it: 1) only point it at domains you trust — it will make outbound HTTP(S) requests and can POST product payloads to the discovered endpoint; 2) be aware SKILL.md mentions external modules (OAuth, Stripe, ledgers) that are not bundled here — full end-to-end flows may require additional skills/credentials later; 3) the code is small and inspectable, but run it in a sandbox or test environment first if the domain is untrusted; and 4) ensure your Node runtime supports global fetch or provide a polyfill when running the CLI.
功能分析
Type: OpenClaw Skill Name: a2a-supermarket Version: 0.2.2 The skill acts as a legitimate orchestration entry point for a commerce workflow, allowing users to publish or discover products via a marketplace API. The implementation in `src/cli/index.js` is a standard Node.js CLI that uses the `fetch` API to interact with user-provided domains and follows the Unified Commerce Protocol (UCP) for service discovery. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.
能力评估
Purpose & Capability
The CLI implements buyer discovery and seller publish by discovering a UCP profile at /.well-known/ucp and calling discovered REST endpoints; this matches the skill name/description. The SKILL.md mentions orchestration and routing to other module skills (Google OAuth, Stripe, ledger, etc.), but those modules are not bundled here — that's plausible for an orchestrator scaffold.
Instruction Scope
Runtime instructions and included code only read stdin/CLI flags and perform HTTP(S) requests to the provided domain's well-known UCP path and REST endpoints. The skill does not read local credential files, environment variables, or unrelated system paths. Its network activity (discovering profile and POST/GET to discovered endpoints) is expected for the stated functionality.
Install Mechanism
No install spec is provided (instruction-only with a small Node CLI file). Nothing is downloaded or installed by the skill bundle, so no install-time code injection concerns are present.
Credentials
The skill declares no required environment variables or credentials, which is consistent with the included code. The SKILL.md references integrations that in full deployments would require credentials (OAuth, Stripe), but those are external modules not present here; this skill itself does not request secrets.
Persistence & Privilege
The skill does not request persistent presence (always is false) and does not modify other skills' configuration or system-wide settings. It runs as an on-demand CLI/orchestrator and has no elevated platform privileges.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install a2a-supermarket
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /a2a-supermarket 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v0.2.2
remove UTF-8 BOM from SKILL.md so OpenClaw can load skill
v0.2.1
add buyer full-list discovery and docs updates
v0.2.0
sync runtime implementation and validation coverage
v0.1.0
create canonical slug a2a-supermarket
元数据
Slug a2a-supermarket
版本 0.2.2
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 4
常见问题

a2a supermarket 是什么?

Unified entry skill for RealMarket A2A commerce workflows. Supports seller product publish and buyer product discovery through UCP market connectivity, plus... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 259 次。

如何安装 a2a supermarket?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install a2a-supermarket」即可一键安装,无需额外配置。

a2a supermarket 是免费的吗?

是的,a2a supermarket 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

a2a supermarket 支持哪些平台?

a2a supermarket 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 a2a supermarket?

由 luoqianchenguni-max(@luoqianchenguni-max)开发并维护,当前版本 v0.2.2。

💬 留言讨论