a2a-Market-ACP-Lite-Negotiation — 技能工具
v0.2.8[自动翻译] Gateway-only ACP negotiation skill with optional OpenClaw model-driven turn decisions.
0· 202·0 当前·0 累计
安全扫描
OpenClaw
可疑
medium confidenceThe skill is broadly coherent with a gateway-based negotiation agent, but the package metadata omits expected runtime requirements (Node and optional LLM API keys) and the code will read environment variables and may send negotiation context to external LLM providers — these mismatches and data-flow implications should be understood before install.
评估建议
This skill is generally what it says: a gateway-focused negotiation CLI that can optionally use an external LLM provider to decide turns. However, note these practical and privacy points before installing or running it:
- The package metadata does not declare Node.js, but the script is a Node CLI. You must run it with node (e.g., node src/cli/index.js).
- If you enable the openclaw decision engine, the tool will look for LLM API keys in environment variables (OPENAI_API_KEY, ANTHROPIC_API_KEY, ...详细分析 ▾
ℹ 用途与能力
The SKILL.md and code implement a gateway-only negotiation CLI (expected network calls to the gateway and optional model-driven decisions). However, the registry metadata lists no required binaries or env vars while the README and code clearly expect to be run with node and optionally use provider API keys (OPENAI_API_KEY etc.). The missing declaration of Node as a required binary and omission of optional provider env variables is an incoherence.
✓ 指令范围
The SKILL.md limits behavior to registering with a gateway, polling for turns, and posting responses; the code shown implements JSON parsing, decision normalization, and optional model-driven parsing. The runtime also reads stdin, command-line flags, and environment variables to build context — all of which are consistent with a CLI agent that interfaces with a gateway and optionally an LLM provider.
✓ 安装机制
There is no install spec (instruction-only deployment), which is low-risk. The bundle does include a Node.js script (src/cli/index.js) that must be executed with node; packaging omitted an explicit 'requires node' declaration. No remote download/install steps are present.
ℹ 凭证需求
The registry lists no required env vars but the code explicitly inspects many common LLM provider env names (OPENAI_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY, etc.) and the SKILL.md documents provider flags. Requesting or using an LLM API key is proportionate to the 'openclaw' decision engine, but the metadata omission means users may not realize they need to provide sensitive credentials. Also passing an API key via the --api-key CLI flag will expose it via process arguments (visible to local users).
✓ 持久化与权限
The skill is not marked always:true and does not claim to modify other skills or global agent configuration. It runs as a user-invoked CLI and requires no permanent platform presence.
⚠ src/cli/index.js:572
Shell command execution detected (child_process).
⚠ src/cli/index.js:497
Environment variable access combined with network send.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.2.82026/3/19
gateway-only mode: remove standalone single-turn decision flow; enforce register/pull/respond session loop
● 无害
安装命令 点击复制
官方npx clawhub@latest install a2a-market-acp-lite-negotiation
镜像加速npx clawhub@latest install a2a-market-acp-lite-negotiation --registry https://cn.clawhub-mirror.com
技能文档
--- name: a2a-market-acp-lite-negotiation description: Gateway-only ACP negotiation skill with optional OpenClaw model-driven turn decisions.
# a2a-Market ACP Lite Negotiation
This skill is now gateway-only. Single-turn local decision mode has been removed.
Gateway Loop Mode (only mode)
Start one participant in one terminal:
node src/cli/index.js --role buyer --agent-id buyer-openclaw --gateway http://127.0.0.1:3085
Flow:
POST /agents/register- Loop
GET /agents/pull POST /agents/respond- For
NEGOTIATION_TURN, decide by selected engine (ruleoropenclaw)
Core flags
--role buyer|seller--gateway(defaulthttp://127.0.0.1:3085)--agent-id--decision-engine rule|openclaw(defaultrule)--auth-token(defaultmarket-auth-token)--pull-timeout-ms(default25000)--retry-delay-ms(default1000)--max-polls(0means infinite)--verbose true|false
OpenClaw engine flags
--provider-env(defaultOPENAI_API_KEY)--api-key(optional direct key)--allow-no-key true|false(defaultfalse)--thinking(defaultlow)--timeoutseconds (default60)--openclaw-extra-prompt(optional)
Auto-start session flags
--start-session true|false--counterparty-agent-id(required with--start-session true)--list-amount-minor-units(default9000)--currency(defaultUSD)--max-rounds(default5)--product(optional)--goal(optional)--floor-minor-units(optional)--ceiling-minor-units(optional)--session-id(defaultnego_)--wait-counterparty-ms(default15000)--stop-on-session-end true|false
Single terminal: run skill + model + auto-kickoff
node src/cli/index.js \
--role buyer \
--agent-id buyer-openclaw \
--gateway http://127.0.0.1:3085 \
--decision-engine openclaw \
--start-session true \
--counterparty-agent-id seller-openclaw \
--list-amount-minor-units 9000 \
--currency USD \
--max-rounds 5 \
--wait-counterparty-ms 30000
Executable Entrypoint
node src/cli/index.js
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制