← 返回 Skills 市场
90
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install skill-alipayplus-integration
功能描述
Alipay+ Payment Integration Assistant. Helps Acquirers and Mobile Service Providers quickly integrate Alipay+ payments, including customer-presented mode pay...
安全使用建议
This skill appears to implement legitimate Alipay+ integration helpers, but review before running: 1) Do not run scripts blindly — inspect them line-by-line (they will generate files under $HOME/.openclaw/workspace and may output private keys). 2) The package.json references ./scripts/install.js which is missing; treat the package as incomplete until resolved. 3) The scripts expect environment variables and SSH key files (SFTP_USER, SFTP_KEY, PARTICIPANT_ID, etc.) that are not declared in the skill metadata — do not supply production credentials; use test/sandbox credentials first. 4) test-signature.sh prints private key material to the console and debug-notify.sh logs incoming webhook payloads; avoid pasting real production private keys into generated config files or leaving them readable on disk. 5) If you need to test webhooks, be cautious when using ngrok (it exposes a public URL); limit exposure and rotate any credentials used for testing. 6) Recommended mitigations: run in an isolated environment or VM, create dedicated test keys/accounts, set strict file permissions on any generated files, and remove generated keys/configs after testing. If you want, I can list the exact lines that print or store sensitive values and suggest minimal edits to make the scripts safer before you run them.
功能分析
Type: OpenClaw Skill
Name: skill-alipayplus-integration
Version: 1.0.0
The skill bundle provides tools for Alipay+ payment integration that include high-risk network and file system operations. Specifically, `scripts/debug-notify.sh` utilizes `netcat` (nc) to listen on local ports and `ngrok` for intranet penetration to facilitate webhook debugging, while `scripts/download-reconciliation.sh` is designed to access the user's SSH directory (~/.ssh/alipayplus_sftp) for SFTP-based data retrieval. Although these behaviors are plausibly aligned with the stated purpose of the skill, the inclusion of tools capable of establishing remote access and accessing private keys represents a significant security risk.
能力标签
能力评估
Purpose & Capability
Name/description match the included artifacts: config generation, signature testing, webhook debugging, and reconciliation — and the shipped scripts implement those tasks. However, package.json declares a bin entry (./scripts/install.js) and an install script that are not present in the file manifest, and the SKILL metadata declares no required environment variables even though the scripts expect several (SFTP_USER, SFTP_KEY, PARTICIPANT_ID, etc.).
Instruction Scope
SKILL.md instructs the agent to run the provided scripts (generate-config.sh, test-signature.sh, debug-notify.sh, reconciliation.sh). The scripts read/write files under $HOME/.openclaw/workspace and ~/.openclaw, expect SFTP keys, may print private key contents to stdout (test-signature.sh prints the generated private key), and debug-notify.sh can start ngrok to expose a local service and logs incoming requests to a local logfile. The SKILL.md did not declare or surface these file/credential operations explicitly, and some script behaviors (printing private keys, logging incoming webhook content) increase risk if run without review.
Install Mechanism
There is no install spec (instruction-only), which is lower risk, but package.json declares a bin ('alipayplus-install': './scripts/install.js') and an install npm script that refer to scripts/install.js which is missing from the manifest. That mismatch is an integrity/packaging concern — it may be an accidental omission or indicate incomplete/untested packaging.
Credentials
Skill metadata lists no required environment variables or primary credential, but the scripts use multiple environment variables and default paths (SFTP_USER, SFTP_HOST, SFTP_KEY, PARTICIPANT_ID, ENV, LOCAL_DIR, and workspace/private key paths). The scripts also default to user-home locations (e.g., $HOME/.openclaw/workspace, ~/.ssh/alipayplus_sftp) and may read files there. The absence of declared env requirements is an inconsistency; you should not provide production private keys or SFTP credentials until you confirm behavior.
Persistence & Privilege
The skill is not 'always:true' and does not request platform-level persistent privileges. It is user-invocable and allows autonomous invocation (default), which is normal. The skill writes files into its own workspace under the user's home directory, which is expected for this type of tool but should be checked for sensitive data retention.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-alipayplus-integration - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-alipayplus-integration触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of Alipay+ Payment Integration Assistant.
- Provides guided assistance for integrating Alipay+ payments, including both customer-presented and merchant-presented modes.
- Features tools for configuration generation, signature verification testing, asynchronous notification debugging (ACQP only), and reconciliation file processing.
- Includes clear boundaries on supported help and referencing of official documentation for detailed API fields and business logic.
- Offers scenario clarification scripts and usage examples for both Acquirer (ACQP) and Mobile Payment Provider (MPP) roles.
- Emphasizes not to guess undocumented details and always refer to official documentation when uncertain.
元数据
常见问题
skill-alipayplus-integration 是什么？
Alipay+ Payment Integration Assistant. Helps Acquirers and Mobile Service Providers quickly integrate Alipay+ payments, including customer-presented mode pay... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 90 次。
如何安装 skill-alipayplus-integration？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-alipayplus-integration」即可一键安装，无需额外配置。
skill-alipayplus-integration 是免费的吗？
是的，skill-alipayplus-integration 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
skill-alipayplus-integration 支持哪些平台？
skill-alipayplus-integration 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 skill-alipayplus-integration？
由 Lizzie（@wypride）开发并维护，当前版本 v1.0.0。
推荐 Skills