← 返回 Skills 市场

调整 token 鉴权机制

Name: 调整 token 鉴权机制
Author: coder-pig

作者 Coder-pig · GitHub ↗ · v0.0.4 · MIT-0

cross-platform ✓ 安全检测通过

303

总下载

当前安装

版本数

在 OpenClaw 中安装

/install fast-claw-paid-api

功能描述

为 Fast Claw 付费演示微服务获取、保存、充值并使用持久 API key。适用于需要发起购买或充值 checkout 流程、把返回的 API key 本地缓存、查询账户余额，或携带 API key 调用 Fast Claw 微服务的场景。

使用说明 (SKILL.md)

Fast Claw Paid API

优先使用随 skill 附带的客户端脚本，不要手写 HTTP 调用。这个脚本会处理本地 API key 缓存、发起首购和充值 checkout、轮询支付完成状态，并用认证头去调用服务。

快速开始

如果服务不在 http://localhost:8033，先设置 FAST_CLAW_SERVICE_URL。先执行 python3 scripts/fast_claw_client.py status 检查本地 API key 状态。如果还没有 API key，执行 python3 scripts/fast_claw_client.py purchase --account-name "\x3C账户名>" --credits 10 --open-browser。提示用户在浏览器里完成购买页。脚本会持续轮询，支付完成后把 API key 保存到 ~/.fast-claw/api-key.json，除非用户通过 FAST_CLAW_API_KEY_PATH 或兼容变量 FAST_CLAW_TOKEN_PATH 指定了别的位置。正常调用服务时执行 python3 scripts/fast_claw_client.py invoke --prompt "..."。需要生成耗时较长的分析报告时，执行 python3 scripts/fast_claw_client.py report --prompt "..."。这个命令会创建异步 report job，并持续轮询直到完成；如果只想先拿 job_id，加上 --no-wait，之后再用 wait-report --job-id ...。给同一个账户充值时执行 python3 scripts/fast_claw_client.py topup --credits 10 --open-browser，不要更换 API key。如果想验证外部跳转，创建 checkout 时传 --success-url "https://www.baidu.com" 即可。

工作流

先用 status 查看本地状态。
如果 API key 缺失或失效，执行 purchase。
如果服务返回余额不足或次数用尽，执行 topup。
需要正式调用时，执行 invoke。
需要测试长耗时任务时，执行 report，或者先 report --no-wait 再 wait-report。
如果用户已经从别的入口拿到了 API key，只需要用 set-api-key 保存一次。

命令说明

status：显示本地 API key 路径、脱敏后的 API key，以及服务端当前余额。
purchase：为新账户创建 checkout 会话，等待支付完成，并把返回的 API key 持久化到本地。
topup：为当前已保存的 API key 创建充值会话。
wait --session-id ...：如果原来的等待超时了，用这个命令继续轮询已有 checkout 会话。
invoke --prompt ...：消耗 1 次额度并调用演示服务。
report --prompt ...：消耗 1 次额度，创建异步分析报告任务，并默认轮询到完成。
wait-report --job-id ...：继续轮询已有 report job，适合 10 到 20 分钟的长任务。
set-api-key --api-key ...：手动保存从其他来源拿到的 API key；旧命令 set-token --token ... 仍可用。
clear-api-key：删除本地保存的 API key；旧命令 clear-token 仍可用。

注意事项

每个账户只保留一个稳定 API key。充值应该增加账户额度，而不是签发新 API key。
本地文件只是 API key 缓存，不是余额来源。真实额度和账户状态始终由后端维护，用户改本地文件只会导致鉴权失败或切到别的有效 API key。
只有在你需要查看底层接口细节，或者想替换掉现有客户端脚本时，才去读 references/service-api.md。

安全使用建议

This skill appears to do what it says: it runs a local client that starts checkout flows, polls for completion, and saves a returned API key to a file. Before installing or running it: 1) verify the Fast Claw service URL you point it at (default is localhost; do not set it to a remote/unknown service unless you trust it), 2) inspect the included scripts (they are small and readable) and confirm the checkout URLs are legitimate before following them, 3) consider setting FAST_CLAW_API_KEY_PATH to a secure location and ensure the saved file has restrictive permissions (so the plaintext API key is not world-readable), and 4) avoid using this skill for highly sensitive credentials or on untrusted machines. If you need stronger protection, require the service to issue short-lived tokens or use a secret store instead of local plaintext files.

功能分析

Type: OpenClaw Skill Name: fast-claw-paid-api Version: 0.0.4 The skill bundle provides a Python client (`scripts/fast_claw_client.py`) and instructions for interacting with a 'Fast Claw' microservice, handling API key management, payment polling, and service invocation. It stores API keys locally in `~/.fast-claw/api-key.json` and uses standard libraries for HTTP communication and browser interaction. The code and instructions are consistent with the stated purpose of managing a paid API service and do not exhibit signs of data exfiltration, malicious execution, or harmful prompt injection.

能力评估

✓ Purpose & Capability

The name/description match the included client script and reference doc. Required env vars referenced by the script (FAST_CLAW_SERVICE_URL, FAST_CLAW_API_KEY_PATH / FAST_CLAW_TOKEN_PATH) are directly related to service endpoint and storage location. No unrelated credentials or binaries are requested.

ℹ Instruction Scope

SKILL.md directs the agent/user to run the bundled Python client which: contacts the configured service URL, opens the browser to a checkout URL returned by the service, polls for completion, and writes an API key to ~/.fast-claw/api-key.json (or a path overridden by env). These actions are expected for this functionality, but they do include writing an unencrypted file to the user home and opening external URLs returned by the service — both are worth attention.

✓ Install Mechanism

Instruction-only skill with a bundled Python script; no install spec or external downloads. Nothing is fetched from third-party URLs during install.

ℹ Credentials

The skill does not request any secrets via declared env variables. It uses optional env vars for service URL and key file path which are appropriate. Note: the script persists API keys in plaintext JSON under the user's home directory and does not explicitly set restrictive file permissions — this is proportional to function but a security consideration.

✓ Persistence & Privilege

always is false, the skill does not request system-wide persistence or modify other skills. It stores only its own API key file under ~/.fast-claw by default.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install fast-claw-paid-api
安装完成后，直接呼叫该 Skill 的名称或使用 /fast-claw-paid-api 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.0.4

- Terminology updated from “token” to “API key” throughout the documentation for clarity. - 改善了 API key 本地缓存机制相关说明，支持兼容变量 `FAST_CLAW_API_KEY_PATH` 和 `FAST_CLAW_TOKEN_PATH`。 - 命令行工具新增与 API key 管理相关的新命令，同时保留旧命令兼容用法。 - 补充了 checkout 流程可自定义跳转 URL 的用法。 - 明确区分本地 API key 缓存与后端账户额度/状态的关系，避免误解。

v0.0.3

- 新增 report 与 wait-report 支持，适合生成和跟踪长耗时的异步分析报告任务。 - 快速开始、工作流、命令说明部分同步补充异步报告相关的用法与流程。 - 原有客户端脚本操作流程未变，仍优先引导用户使用脚本避免手写 HTTP。 - 补充对 report 命令 --no-wait 用法的指导

v0.0.2

- 稍微调整了一下 Prompt

v0.0.1

Initial release of the Fast Claw Paid API skill. - Supports purchasing, saving, recharging, and using persistent tokens for Fast Claw microservices. - Provides a client script for handling token storage, checkout flows, polling payment status, and authenticated service calls. - Includes commands to check token status, purchase credits, top up, invoke services, set and clear tokens. - Emphasizes using the provided client script over manual HTTP requests for reliability and security.

元数据

Slug fast-claw-paid-api

版本 0.0.4

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 4

常见问题