← 返回 Skills 市场
74
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install my-pay
功能描述
A payment skill powered by mypay-bot CLI. Use this skill whenever the user wants to pay, make a payment, purchase something, buy items, checkout, transfer mo...
安全使用建议
This skill mostly looks like a straightforward wrapper around an npm CLI, but two issues merit caution: (1) the SKILL.md requires sensitive env vars (MYPAY_API_KEY and MYPAY_WALLET_SECRET) and node/npm/python3, yet the registry metadata omits those requirements — treat that as an inconsistency and do not provide secrets until you confirm the publisher and necessity; (2) the skill instructs the agent to display and preserve payment URLs and tokens exactly, which can reveal secrets if outputs are forwarded or logged. Before installing or enabling: verify the mypay-bot npm package and its publisher (check npmjs.org and package source), confirm the skill publisher identity, ensure you only provide credentials to a trusted publisher, restrict where the agent can send outputs (don’t allow automatic external posting), and consider running the included Python checker yourself to confirm it only reports status (it appears to). If you cannot confirm the mypay-bot package provenance and the skill publisher, treat the missing metadata and the instruction to surface raw tokens as an unacceptable risk.
功能分析
Type: OpenClaw Skill
Name: my-pay
Version: 1.0.1
The 'my-pay' skill is a standard integration for a payment CLI tool (mypay-bot). It includes a Python dependency checker (scripts/install_mypay.py) that safely verifies the installation and version of the required npm package without performing any automatic or unauthorized installations. The instructions in SKILL.md are well-structured, guiding the agent through a multi-step payment workflow while emphasizing the importance of preserving payment links and requiring manual user intervention for credential setup and package installation.
能力标签
能力评估
Purpose & Capability
The SKILL.md and included Python checker align with a mypay-bot CLI integration: requiring node/npm, python3, and two MyPay credentials is reasonable for this payment skill. However, the registry metadata at the top of the package lists no required env vars or binaries, which contradicts the documented runtime requirements — this metadata mismatch is an incoherence that should be resolved before trusting automatic installation or credential configuration.
Instruction Scope
The instructions tell the agent to run included commands (the Python checker and mypay-bot CLI) and to strictly preserve URLs and images "character for character," explicitly including query parameters and tokens. That instruction could lead to sensitive tokens being shown or copied exactly as-is; while it may be required for payment links, it increases the risk of accidental exposure or exfiltration if the agent is allowed to transmit outputs elsewhere. The instructions also say to "cache the summary" without specifying where or how, leaving storage and retention ambiguous.
Install Mechanism
There is no automatic install spec — the included scripts are a dependency checker only and do not modify the system or run npm install. The Python script does call shell commands via subprocess.run(..., shell=True) to run npm list; this is expected for a checker but is worth noting because it executes shell commands. Overall install risk is low because installs are manual per the instructions.
Credentials
The skill requires two sensitive credentials in SKILL.md (MYPAY_API_KEY and MYPAY_WALLET_SECRET), which are proportionate for a payment/wallet integration. The problem is the package's registry metadata did not declare these required environment variables — that mismatch is a red flag because users (and automated permission UIs) may not be prompted for the secrets the skill actually needs.
Persistence & Privilege
The skill does not request persistent system presence (always:false), does not modify other skills or system-wide config, and explicitly instructs users to run installs manually. No elevated persistence or unusual privileges are requested.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install my-pay - 安装完成后，直接呼叫该 Skill 的名称或使用
/my-pay触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
my-pay 1.0.1 adds explicit system requirements and credential checks to improve reliability and transparency.
- Added system requirements section specifying python3, node, npm, and mypay-bot CLI.
- Introduced mandatory environment credentials (MYPAY_API_KEY, MYPAY_WALLET_SECRET) with usage instructions.
- The prerequisite script now only checks for installation/version and never modifies the system.
- Installation and updates for mypay-bot must be performed manually by the user; automatic npm install was removed.
- Compatibility and credential requirements are now documented using structured metadata.
v1.0.0
Initial release of the mypay payment skill.
- Handles payment workflows using the mypay-bot CLI tool.
- Guides users through capturing payment intent, checking wallet status, and submitting payments.
- Enforces strict step-by-step flow and command order.
- Prerequisite script checks for installation and update of mypay-bot before each use.
- Maintains all command output links and images exactly as provided.
元数据
常见问题
my-pay 是什么？
A payment skill powered by mypay-bot CLI. Use this skill whenever the user wants to pay, make a payment, purchase something, buy items, checkout, transfer mo... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 74 次。
如何安装 my-pay？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install my-pay」即可一键安装，无需额外配置。
my-pay 是免费的吗？
是的，my-pay 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
my-pay 支持哪些平台？
my-pay 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 my-pay？
由 xhc1111（@xhc1111）开发并维护，当前版本 v1.0.1。
推荐 Skills