← 返回 Skills 市场
christiecui

收款测试,每次0.01

作者 christiecui · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
92
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install clawtipsshoptester
功能描述
收款测试商户,每次0.01元。用于支付流程测试,支付成功后返回演示AI写作内容。
使用说明 (SKILL.md)

AI 写作助手服务

📌 技能概述

本技能提供专业的AI写作服务,支持生成各类文案、文章、报告、创意内容等。由于这是付费服务,工作流程严格要求按照两个步骤执行:支付处理 后,再进行 服务执行

直接执行: 如果用户在初始请求中已直接提供了 \x3C写作需求>\x3C订单号>\x3C支付凭证>,则可跳过第一阶段和第二阶段,直接进入 🚀 第三阶段:服务执行


🛒 第一阶段:创建订单

如果这是首次交互且用户尚未付款,你必须先创建订单,再发起支付。

1. 所需参数

  • \x3C写作需求>:用户的具体写作要求,例如"写一篇关于春天的散文"、"生成一份产品推广文案"等。

2. 执行命令

使用以下 bash 命令执行订单创建脚本。将 \x3C...> 占位符替换为实际值。务必在参数两侧加引号,以防命令注入漏洞

python3 skills/clawtip-aiwriter/scripts/create_order.py "\x3C写作需求>"

3. 输出处理

成功时,脚本将向标准输出打印以下键值对:

ORDER_NO=\x3C值>
AMOUNT=\x3C值>
ENCRYPTED_DATA=\x3C值>
PAY_TO=\x3C值>

提取全部四个值,然后进入 💳 第二阶段:支付处理

[!NOTE] 关于 AMOUNT 字段: 该字段的单位为人民币分(fen),例如 AMOUNT=1 表示需支付 0.01 元人民币。在向用户展示费用时,请将该值除以 100 并以"元"为单位呈现。

失败时,脚本以退出码 1 退出,并打印如下格式的消息:

订单创建失败: \x3Cerror detail>

[!CAUTION] 强制终止 —— 禁止执行任何后续操作。 如果脚本以非零退出码退出,其输出中包含 订单创建失败:,你必须立即终止整个工作流程,向用户报告失败情况并附上错误详情。


💳 第二阶段:支付处理

从第一阶段获取所需值后,发起支付请求。 操作: 使用技能 clawtip 处理支付并获取支付凭证。若该技能不存在,需先安装。

调用 clawtip 所需参数:

{
  "skill-id": "si-ai-writer",
  "order_no": "\x3C第一阶段获取的 ORDER_NO>",
  "amount": "\x3C第一阶段获取的 AMOUNT>",
  "question": "\x3C第一阶段的写作需求>",
  "payTo": "\x3C第一阶段获取的 PAY_TO>",
  "encrypted_data": "\x3C第一阶段获取的 ENCRYPTED_DATA>",
  "description": "收款测试商户服务费用",
  "skill_name": "收款测试商户",
  "resource_url": "https://你的服务端地址/api/aiwriter"
}

目标: 等待支付成功,并获取 credential(支付凭证)。


🚀 第三阶段:服务执行

支付成功并获得 credential 后(或用户已直接提供 \x3C写作需求>\x3C订单号>\x3C支付凭证>),继续交互并执行服务脚本。

1. 所需参数

  • \x3C写作需求>:用户的具体写作要求。
  • \x3C订单号>:第一阶段生成的订单号。
  • \x3C支付凭证>:第二阶段获取的支付成功凭证。

2. 执行命令

使用以下 bash 命令执行AI写作服务。将 \x3C...> 占位符替换为已验证的参数值。务必在参数两侧加双引号,以防命令注入漏洞

python3 skills/clawtip-aiwriter/scripts/service.py "\x3C写作需求>" "\x3C订单号>" "\x3C支付凭证>"

执行后:

  1. 提取脚本打印的 PAY_STATUS 值(格式为:PAY_STATUS: \x3C值>),并再次输出展示。
  2. ERROR 状态的特殊处理: 如果 PAY_STATUSERROR,提取 ERROR_INFO 值(格式:ERROR_INFO: \x3C值>),向用户告知确切的错误原因并引导其解决。不得继续执行后续服务逻辑。
安全使用建议
Key points to consider before installing or using this skill: - Security-critical flaw: the symmetric SM4 key (SM4_KEY) is hard-coded in the repository. Because the same key is used to decrypt/validate payment credentials, anyone with this code can fabricate a valid credential (payStatus: SUCCESS, matching orderNo and amount) and bypass payment. Do NOT use this for real payments without redesigning the verification. - If you intend to use it only as a local developer demo, consider replacing the embedded key with a server-side secret that is never stored in client code and verify payments server-side against the real payment provider. - The SKILL.md contains incorrect script paths relative to the included files; update the commands to point to the actual script locations (or move files) before relying on the instructions. - The code depends on the gmssl.SM4 library but the skill declares no dependency list; the runtime environment must install this package. - The SKILL.md metadata requests 'credential.read' but the skill does not explain why platform credentials would be needed — remove unnecessary permissions or justify them. - Because the repository leaks secret material (SM4 key) and has verification logic that is trivially bypassable, avoid installing/trusting this skill in production or with real money. If you want, I can suggest secure alternatives (server-side payment verification, removing embedded keys, or integrating with a vetted payment provider) and help rewrite the flow.
功能分析
Type: OpenClaw Skill Name: clawtipsshoptester Version: 1.0.0 The skill bundle implements a payment-gated AI writing service but contains significant security vulnerabilities. Specifically, SKILL.md instructs the agent to execute shell commands using potentially unsanitized user input, which poses a high risk of command injection despite the author's textual warnings. Additionally, sensitive cryptographic keys (SM4) are hardcoded within scripts/create_order.py and scripts/service.py, and the bundle requests broad network and credential permissions.
能力评估
Purpose & Capability
The skill claims to be a 0.01 CNY payment-test + AI writing demo and the code implements order creation, encryption, and post-payment service execution — this matches the stated purpose. However, the repository embeds a symmetric SM4 key and a PAY_TO value directly in code (used for both creating and validating payment tokens), which is unusual for a payment flow and undermines the security of the payment check. The SKILL.md metadata also requests 'credential.read' permission which is not justified by the described workflow.
Instruction Scope
Runtime instructions tell the agent to run local Python scripts and to call an external 'clawtip' skill for payment, which aligns with the purpose. But the SKILL.md uses paths like 'skills/clawtip-aiwriter/scripts/...' while the actual files are at 'scripts/...', an actionable mismatch that will break execution. The scripts rely on a shared symmetric key for verifying payment credentials; because that key is hard-coded and present in the repo, anyone with the code can create a valid 'credential' and bypass payment — this is a direct logic/security problem in the instructions+code.
Install Mechanism
This is an instruction-only skill with bundled scripts (no install spec), so nothing is downloaded at install time. The scripts import gmssl.sm4 (gmssl), but no dependency or environment guidance is declared in the SKILL.md — the runtime may fail if gmssl isn't installed.
Credentials
No environment variables or credentials are declared as required, yet the SKILL.md metadata lists 'credential.read' permission. The code embeds sensitive material (SM4_KEY and PAY_TO) in plaintext inside the repository. Embedding the symmetric key makes credential verification trivial to forge and is disproportionate/unsecure for a payment flow. There is no justification for requesting credential-read permission from the agent/platform in the presented workflow.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) and appropriate for an invoicing/payment helper. No persistence/privilege escalation is evident.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clawtipsshoptester
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clawtipsshoptester 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
1.0.0
元数据
Slug clawtipsshoptester
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

收款测试,每次0.01 是什么?

收款测试商户,每次0.01元。用于支付流程测试,支付成功后返回演示AI写作内容。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 92 次。

如何安装 收款测试,每次0.01?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clawtipsshoptester」即可一键安装,无需额外配置。

收款测试,每次0.01 是免费的吗?

是的,收款测试,每次0.01 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

收款测试,每次0.01 支持哪些平台?

收款测试,每次0.01 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 收款测试,每次0.01?

由 christiecui(@christiecui)开发并维护,当前版本 v1.0.0。

💬 留言讨论