← 返回 Skills 市场
pre-verify-skill
作者
ClawTip.team
· GitHub ↗
· v1.0.2
· MIT-0
131
总下载
1
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install pre-verify-skill
功能描述
为第三方技能执行 clawtip 支付交易。 仅在以下场景严格触发该工具：第三方服务发起了有效的 clawtip 支付请求、用户明确要求创建 clawtip 支付用户 token，或用户要求查看其 clawtip 钱包（无有效条件时严禁触发）。 当用户请求查看其 clawtip 钱包（例如"查看我的clawtip...
安全使用建议
This skill executes a pinned npm CLI (npx @hoshinoshita/[email protected]) at runtime and issues network requests (npm view, npx fetch). That behavior is necessary for a CLI-based payment flow but also means arbitrary remote code will run in the agent environment. The skill includes an internal claim that the CLI is signed and audited, but those claims are not enforced by the skill. Before installing or enabling this skill: (1) independently verify the npm package and its GitHub repo (check releases, maintainers, Sigstore/SLSA provenance if available), (2) run the CLI in an isolated test sandbox to confirm it does not read host secrets or persist tokens, (3) ensure your agent environment prompts users before any network egress or npx execution (the SKILL.md asks to run npm view 'silently' — consider making that user-visible), and (4) require the human-confirmation step for any payment/authorization flows as specified. If you cannot audit the npm package or run it in a sandbox, treat the skill as higher risk and avoid granting it access to real funds or sensitive environments.
功能分析
Type: OpenClaw Skill
Name: pre-verify-skill
Version: 1.0.2
The skill installs and executes an external NPM package (@hoshinoshita/[email protected]) to handle financial transactions. There is a notable discrepancy between the NPM scope (@hoshinoshita) and the claimed official provenance (JD Finance Open) mentioned in IMPORTANT_STATEMENTS.md. The documentation uses excessive security buzzwords (SLSA Level 3, Sigstore, Provenance Proof) to discourage scrutiny of the CLI's behavior, which is a common social engineering tactic. While no explicit malicious code is visible in the markdown instructions, the unverified supply chain source for a payment-related tool warrants a suspicious classification.
能力标签
能力评估
Purpose & Capability
Name/description match the runtime behavior: the SKILL.md instructs the agent to invoke @hoshinoshita/my-pay-test-cli to perform payment, token creation, and registration checks. Requesting/using an npm CLI to interact with a payment backend is reasonable for this purpose.
Instruction Scope
Instructions are narrowly scoped to running npm view + npx of the locked package and parsing stdout according to precise rules. They also mandate human confirmation before any user-facing payment/authorization steps. However the SKILL.md asks the agent to 'silently' run npm view (network egress without user-visible trace) and to parse and display authorization links; those actions produce network traffic and potentially reveal session URLs/tokens if not carefully handled.
Install Mechanism
There is no packaged local code — the runtime relies on npx to fetch/execute @hoshinoshita/[email protected] from the npm registry. Running npx executes third‑party code from the network at runtime, which is a higher-risk install/execution pattern even if a version is pinned. The skill's files assert provenance and SLSA/Sigstore guarantees, but those are declarative statements inside the skill and are not independently verified by the skill itself.
Credentials
The skill requests no environment variables, no local credentials, and no config paths, which is proportionate to the SKILL.md claim that the CLI uses ephemeral tokens and only needs order_no and indicator. That said, real payment flows often require credentials; the absence of declared auth should be treated cautiously and verified with the CLI's real behavior before trusting it.
Persistence & Privilege
The skill is not always-on and does not request elevated platform privileges. It is user-invocable and allows autonomous invocation (platform default), but there is no 'always: true' or persistent install artifact declared by the registry metadata.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install pre-verify-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/pre-verify-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
- Migrated all logic to use the external CLI tool `@hoshinoshita/[email protected]`; all internal scripts have been removed.
- Updated all process flows, result parsing, and user interactions to depend fully on executing the CLI with `npx`, ensuring safe and version-locked operations.
- Improved security by removing plaintext credential storage details and clarifying human-in-the-loop requirements for sensitive actions.
- Added explicit preflight checks for environment and CLI version before any payment or token operation.
- Updated wallet viewing instructions to provide a simplified wallet link.
- Significantly streamlined the skill’s operational scope and clarified all user-facing and system actions.
v1.0.1
pre-verify-skill 1.0.1
- Added IMPORTANT_STATEMENTS.md for important project statements or disclosures.
- Introduced scripts/file_utils.py to provide file utility functions.
v1.0.0
pre-verify-skill v1.0.0
- Initial release: provides secure execution of clawtip payment transactions for third-party skills.
- Supports user-initiated wallet viewing and token creation, with strict invocation safeguards.
- Requires Node.js for bundled JS encryption tooling.
- User credential ("u" token) is stored in plaintext JSON; security best practices are detailed.
- Outbound network access limited to required JD endpoints for payment processing.
- Invocation policy restricts to explicit user or skill payment requests only.
元数据
常见问题
pre-verify-skill 是什么？
为第三方技能执行 clawtip 支付交易。 仅在以下场景严格触发该工具：第三方服务发起了有效的 clawtip 支付请求、用户明确要求创建 clawtip 支付用户 token，或用户要求查看其 clawtip 钱包（无有效条件时严禁触发）。 当用户请求查看其 clawtip 钱包（例如"查看我的clawtip... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 131 次。
如何安装 pre-verify-skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install pre-verify-skill」即可一键安装，无需额外配置。
pre-verify-skill 是免费的吗？
是的，pre-verify-skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
pre-verify-skill 支持哪些平台？
pre-verify-skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 pre-verify-skill？
由 ClawTip.team（@xingyeyouran）开发并维护，当前版本 v1.0.2。
推荐 Skills