← 返回 Skills 市场
66
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install lobpay
功能描述
Purchase items, pay merchants, retrieve checkout info, record transactions, and leave feedback via X402 protocol on the Base network using LobPay.
使用说明 (SKILL.md)
🦞 LobPay Agent Skill
AI-powered commerce via X402 protocol on Base network.
🚀 Quick Start
cd ~/.openclaw/workspace/skills/lobpay/scripts
npm install
🔧 Configuration
Set environment variables (optional):
LOBPAY_API_URL=https://lobpay.cash # Default: https://lobpay.market
📋 Core Workflows
1. Purchase Items
Get checkout info first:
node checkout.js \x3Cproduct_id> [quantity]
Then complete purchase:
node purchase.js \x3Cproduct_id> [quantity]
Combined quick purchase:
node buy.js \x3Cproduct_id> [quantity]
2. Leave Feedback
# Rate last purchase
node feedback.js \x3Crating> "\x3Ccomment>"
# Rate specific transaction
node feedback.js \x3Ctransaction_id> \x3Crating> "\x3Ccomment>"
3. View Purchase History
node history.js [limit]
🔗 API Endpoints
| Endpoint | Method | Auth | Purpose |
|---|---|---|---|
/api/v1/public/checkout-info |
GET | Public | Get pricing & merchant wallet |
/api/v1/agents/purchase |
POST | API Key + X402 | Execute purchase |
/api/v1/agents/feedback |
POST | API Key | Leave rating/comment |
/api/v1/agents/history |
GET | API Key | View transactions |
💰 X402 Payment Flow
- Checkout → Get merchant wallet + pricing
- Sign → Create X402 payment header
- Purchase → Send to
/agents/purchasewith payment proof - Confirm → Transaction recorded on Base
See references/api.md for detailed request/response schemas.
🛡️ Security
- Private keys stored in
~/.lobpay/config.json - X402 headers signed locally
- API keys only sent to configured endpoints
- Supports Base Sepolia (testnet) and Base Mainnet
📚 References
references/api.md- Full API documentationreferences/schemas.md- Database schemasreferences/x402.md- X402 protocol details
安全使用建议
Install only if you are comfortable giving this skill a dedicated wallet private key and API key. Use a low-balance test wallet first, verify the API endpoint before use, require explicit confirmation before every purchase, and avoid using mainnet or high-value funds until the dependency versions, credential storage, and spending controls are improved.
功能分析
Type: OpenClaw Skill
Name: lobpay
Version: 1.0.0
The LobPay skill facilitates automated commerce via the X402 protocol on the Base network, but it employs high-risk security practices for handling sensitive credentials. Specifically, `register.js` accepts a plaintext private key as a command-line argument and stores it, along with an API key, in an unencrypted JSON file at `~/.lobpay/config.json`. While these capabilities are plausibly needed for the stated purpose of local transaction signing, they represent significant security vulnerabilities (exposure via process monitoring and insecure local storage). The core logic in `buy.js` and `purchase.js` appears to correctly implement the X402 payment flow using the `viem` library, and no evidence of intentional data exfiltration or malicious command execution was found.
能力标签
能力评估
Purpose & Capability
The stated purpose is coherent with the code: it retrieves checkout data, signs X402 payments, submits purchases, stores history, and leaves feedback. However, those are high-impact financial/account actions and the artifacts do not define spending caps, merchant allowlists, rollback behavior, or a required final user confirmation before purchase.
Instruction Scope
The skill documents direct purchase commands including a combined quick-buy flow, and the scripts execute the payment request once invoked. The instructions do not clearly require the agent to stop for user approval after showing price/merchant details.
Install Mechanism
The skill is described as instruction-only, but SKILL.md tells users to run npm install and package.json uses version ranges for payment/wallet-related dependencies. This is expected for a Node-based payment integration, but users should audit and pin dependencies before using a real wallet.
Credentials
Registry requirements declare no credentials, environment variables, or config paths, while the code requires a private key and API key in ~/.lobpay/config.json and supports an endpoint-changing LOBPAY_API_URL. The documented default API URL also differs from the code default.
Persistence & Privilege
The skill persists raw wallet private keys and API keys in a local JSON file, then reuses them to sign payments and authenticate API calls. It also stores local checkout and purchase history.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install lobpay - 安装完成后，直接呼叫该 Skill 的名称或使用
/lobpay触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
lobpay 1.0.0
- Initial release of the LobPay Agent Skill, enabling item purchases via the X402 protocol on the Base network.
- Supports product checkout, X402-based payment, purchase history viewing, and merchant feedback/rating.
- Provides CLI scripts for checkout info retrieval, purchase, quick buy, feedback submission, and transaction history.
- Integrates with LobPay API endpoints for commerce workflows and secure payment confirmation.
- Includes configuration for environment variables, security best practices, and reference documentation.
元数据
常见问题
LobPay 是什么？
Purchase items, pay merchants, retrieve checkout info, record transactions, and leave feedback via X402 protocol on the Base network using LobPay. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 66 次。
如何安装 LobPay？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install lobpay」即可一键安装，无需额外配置。
LobPay 是免费的吗？
是的，LobPay 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
LobPay 支持哪些平台？
LobPay 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 LobPay？
由 Amir（@web3senior）开发并维护，当前版本 v1.0.0。
推荐 Skills