jd-payment-process-skill — 技能工具
v1.0.0[自动翻译] Executes a JD payment transaction for third-party skills. Trigger this tool strictly when a third-party service initiates a valid JD payment request. ...
0· 347·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
high confidenceThe skill claims to execute JD payment transactions and requests network/credential permissions, but the included code is a local stub that returns a fixed test token and does not perform real network or credential operations — the declared capabilities and permissions do not match the actual implementation.
评估建议
This skill appears to be a stub or incomplete: it advertises payment-processing capabilities and requests network/credential permissions, but the code only prints inputs and returns a fixed test token. Do not use this for real payments. Before installing or invoking: (1) verify the skill's origin and author; (2) request a clear explanation of where real payment settlement occurs and what credentials/API endpoints are required; (3) review or request a version that integrates with a real payment p...详细分析 ▾
⚠ 用途与能力
Name/description claim this executes JD payment transactions for third-party skills. However, the shipped Python code only prints the input and returns a constant test token; it performs no real payment, no network calls, and requires no credentials. That is a substantive mismatch between claimed capability and actual behavior.
⚠ 指令范围
SKILL.md instructs the agent to run the provided script with validated parameters and advertises strict parameter formats and constraints, but the script itself only converts the amount to int and does not validate wallet/payer formats or enforce the stated constraints. SKILL.md also lists permissions (network.outbound, credential.read) that are not used by the script, which could mislead users or agents about expected actions.
✓ 安装机制
No install spec (instruction-only plus a small included script). Nothing is downloaded or written to disk beyond the provided files, so install mechanism risk is low.
⚠ 凭证需求
The skill declares permissions for network and credential reading in SKILL.md, but requires no environment variables or keys and the code does not access env vars or credentials. Either permissions are unnecessary (over-declared) or the implementation is incomplete; both are problematic for a payment processor.
✓ 持久化与权限
always is false and the skill does not request persistent agent-wide configuration or modify other skills. Autonomous invocation is allowed (platform default) but not accompanied by other high privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/13
- Initial release of jd-payment-process-skill. - Enables execution of JD payment transactions for third-party skills. - Requires merchant wallet address, transaction amount, and payer authorization signature as inputs. - Strict input format and validation guidelines provided. - Resource decryption not supported in this version.
● 无害
安装命令 点击复制
官方npx clawhub@latest install jd-payment-process-skill
镜像加速npx clawhub@latest install jd-payment-process-skill --registry https://cn.clawhub-mirror.com
技能文档
# Process the Payment Request
1. Required Parameters
Provide the following parameters strictly according to their defined formats:merchant_wallet_address (string): The merchant's wallet token.
Format: Must begin with mer- (e.g., mer-x1y2z3).
amount (integer): The transaction amount.
Constraint: Must be an integer between 1 and 1000.
payer_authorization_sign (string): The payer's authorization signature.
Format: Must begin with sign- (e.g., sign-a1b2c3).
2. Execution Command
Execute the script using the following bash command. Replace the placeholders<...> with the validated parameter values. Do not use quotes around the parameters unless they contain spaces.
```bash
python3 skills/jd-payment-skill/scripts/payment_process.py 数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制