← 返回 Skills 市场
1944
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install mayar-payment-skill
功能描述
Integrate Mayar.id for Indonesian payments to create invoices, generate payment links, track transactions, manage subscriptions, and automate payment workflo...
安全使用建议
This skill looks like a real Mayar payment integration, but take care before installing: 1) The package metadata doesn't list the API key or required binaries even though SKILL.md requires a Mayar JWT and mcporter/Node (metadata mismatch). 2) Review and protect your API token — the docs tell you to store it in ~/.config/mayar/credentials and to embed it in config/mcporter.json; prefer using your platform's secret storage if available and avoid committing configs to VCS. 3) The mcporter config uses `npx mcp-remote`, which will fetch and execute code from npm at runtime — verify the 'mcp-remote' package (author, version, audit) before enabling, since dynamic npx execution can run arbitrary code. 4) Test in a sandbox/sandbox Mayar environment (web.mayar.club) first and validate webhook handling and token scope. 5) If you need higher assurance, ask the skill author for the exact npm package version, a checksum, or a signed release and for updated registry metadata that declares the required credential and binaries.
功能分析
Type: OpenClaw Skill
Name: mayar-payment-skill
Version: 1.0.0
The skill is classified as suspicious primarily due to the use of `npx -y mcp-remote` in `SKILL.md` and `README.md`. While this command is intended to install and run a legitimate tool for the Model Context Protocol, the use of `npx -y` allows for the download and execution of a remote package without explicit user confirmation, posing a supply chain risk. All other operations, such as storing API tokens locally and making `mcporter` calls to Mayar.id domains, are aligned with the stated purpose of payment integration.
能力评估
Purpose & Capability
The SKILL.md and README clearly describe a Mayar.id payment integration (invoice creation, transaction queries, webhooks) and the included references align with that purpose. HOWEVER the registry metadata did not declare any required credentials or binaries even though the documentation requires an API key, mcporter, and Node/npx — this metadata omission is an inconsistency.
Instruction Scope
Instructions stay within the payment-integration scope (create credentials file, add mcporter server, call mcporter tools, register webhooks). They do instruct writing credentials to ~/.config/mayar/credentials and embedding the API token into config/mcporter.json Authorization header (which is functionally necessary but can leak if configs are not handled securely). No instructions ask the agent to read unrelated system files or exfiltrate data to unexpected endpoints; endpoints referenced are Mayar domains.
Install Mechanism
There is no formal install spec (instruction-only), but the mcporter configuration calls npx mcp-remote at runtime. That implies dynamic download-and-execute of the 'mcp-remote' npm package when mcporter starts. The skill/package does not declare or vet that package in the metadata; dynamic npx execution is a higher-risk behavior and should be reviewed (verify the npm package source and integrity) before enabling.
Credentials
The skill requires a sensitive Mayar API JWT token (documented in SKILL.md) but the registry metadata declares no required env vars or primary credential — a mismatch. The instructions ask you to store the token in a local credentials file and to place it in the mcporter.json Authorization header; this is proportional to the payment use-case but is sensitive and should be protected (platform-managed secret store preferred).
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and has no install that writes persistent system-wide components. Its persistence is limited to the user-supplied credential file and mcporter configuration, which is expected for this integration.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install mayar-payment-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/mayar-payment-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of mayar-payment-skill: Mayar.id payment integration via MCP.
- Enables invoice generation, payment links, and transaction tracking for Indonesian payment workflows.
- Supports WhatsApp-friendly payment messages and a variety of Indonesian payment methods (bank transfer, e-wallet, QRIS).
- Includes examples for creating invoices, checking payment status, and managing subscriptions/memberships.
- Provides setup instructions for API credentials, MCP configuration, and testing integration.
- Offers actionable troubleshooting and a production checklist for deployment.
元数据
常见问题
Mayar.id Payment 是什么？
Integrate Mayar.id for Indonesian payments to create invoices, generate payment links, track transactions, manage subscriptions, and automate payment workflo... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1944 次。
如何安装 Mayar.id Payment？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install mayar-payment-skill」即可一键安装，无需额外配置。
Mayar.id Payment 是免费的吗？
是的，Mayar.id Payment 完全免费（开源免费），可自由下载、安装和使用。
Mayar.id Payment 支持哪些平台？
Mayar.id Payment 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Mayar.id Payment？
由 ahsanatha（@ahsanatha）开发并维护，当前版本 v1.0.0。
推荐 Skills