by 安全扫描
OpenClaw
安全
medium confidence该技能的指令与客户端工作流一致，用于通过 Tributary/Lando 生成索拉纳（USDC）支付 URL，不要求额外凭证或安装任意代码，但包/源代码未链接，元数据较少。
评估建议
该技能似乎是客户端生成索拉纳（USDC）支付 URL 的指南，不要求机密信息或安装任意二进制文件——风险较低。使用前，请验证 npm 包名 (@tributary-so/*) 和检查包源（或使用审查过的注册表）以确保其合法性。确认只提供公钥（收件人/网关），不提供私钥或钱包种子。由于技能元数据缺乏主页/源，视其所有者为未验证的，建议自己审查所引用 SDK 代码或使用已知的官方 SDK 实现。...详细分析 ▾
✓ 用途与能力
The SKILL.md describes creating Solana (USDC) checkout URLs using a Tributary/Lando Payments SDK — this matches the skill name 'Solana Payments'. The absence of required env vars or binaries is reasonable because generating encoded checkout URLs is a client-side operation that does not require secrets. Minor note: skill metadata (no description/homepage/source) and the SKILL.md heading 'Lando Payments Url Creation' differ slightly from the published name but this is plausibly just naming/branding.
✓ 指令范围
Instructions stay focused on building checkout sessions and forming encoded URLs, include example code (npm install, TypeScript usage), and do not instruct the agent to read system files, secrets, unrelated env vars, or to transmit sensitive keys. The examples reference only public keys and client-side redirects.
✓ 安装机制
This is an instruction-only skill with no install spec or bundled code; the SKILL.md suggests installing an npm SDK (@tributary-so/sdk) which is a normal, proportional dependency for a JavaScript integration. There is no embedded download URL or archive extraction in the skill itself.
✓ 凭证需求
No environment variables, credentials, or config paths are requested. The SDK examples use public keys (token mint, gateway, recipient); they do not ask for private keys or tokens. The requested data is proportional to the described purpose.
✓ 持久化与权限
Skill does not request always:true and it has no install-time persistence. Model invocation is enabled (default) but that's normal. The skill does not modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/8
初始发布：Solana 上 USDC 订阅支付的 Lando 支付 URL 指南。-涵盖使用 Payments SDK 和 Lando 主机流创建和编码支付会话。-记录所有必需和可选参数用于会话创建。-解释 URL 编码、支付频率、跟踪 ID 和备忘录使用。-提供集成、错误处理和最佳实践的代码示例。-包括输入验证、会话测试和唯一跟踪 ID 生成的指导。
● 无害
安装命令 点击复制
官方npx clawhub@latest install solana-payments
镜像加速npx clawhub@latest install solana-payments --registry https://cn.clawhub-mirror.com
技能文档
概述
使用 Tributary Payments SDK 创建索拉纳 USDC 订阅支付 URL...（**注意：由于原始内容中未提供完整的 SKILL.md 内容，只提供了一个示例开头。实际翻译中，请替换为完整的 SKILL.md 中文翻译，保留 YAML frontmatter、代码块、命令行指令和 Markdown 格式）
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制