首页 / 技能 / psychological-counseling — 专业心理顾问

📦 psychological-counseling — 专业心理顾问

v1.0.5

基于用户问题提供专业心理建议的付费服务，需先完成支付验证后启动。

0· 135·1 当前·1 累计
xingyeyouran 头像by @xingyeyouran (ClawTip.team)
智能体生产力工具
下载技能包
最后更新
2026/4/1
0
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
可疑
medium confidence
The skill's code and instructions are inconsistent with its description and contain several red flags (broken/ambiguous run command, inconsistent payment endpoints, instructions that forbid inspecting the shipped scripts, and outbound network calls that will transmit user data); proceed only after clarification and code review in an isolated environment.
评估建议
Things you should consider before installing or using this skill: - Do not provide real payment credentials or sensitive personal data until you verify the payment flow and endpoints. The scripts post user questions and payment-related data to an external domain (ms.jr.jd.com), which is different from the resource_url declared in the instructions (psychological-master.com). - The Phase 3 run command in SKILL.md is malformed (missing the counseling.py filename). Ask the author to correct it and ...
详细分析 ▾
⚠ 用途与能力
The skill claims to be a paid psychological counseling service and references a payment verification step, but the actual network endpoints in the shipped scripts point to ms.jr.jd.com (JD) while the SKILL.md's resource_url is psychological-master.com. The declared capability 'payment.process' is plausible for a paid service, but the specific external endpoints/domains are inconsistent with the skill metadata and owner, which is suspicious.
⚠ 指令范围
SKILL.md instructs the agent to execute local Python scripts and to call another skill (clawtip-pre-verify). Phase 3's execution command is malformed (missing the counseling.py filename), meaning the instructions as-written are incorrect. The instructions include a 'HARD STOP' that explicitly forbids inspecting the script source or retrying on failure — telling the agent not to inspect local code is unusual and suspicious. Both scripts send user question and payment-related data to external servers (network.outbound) — expected for a remote service but should be explicit and consistent with the declared domains.
ℹ 安装机制
There is no external install spec (no downloads or package installs), which reduces some risk. However, the skill ships two Python scripts that will be executed locally; those scripts will be written to disk as part of the skill bundle. Because no install step pulls remote code, there is less supply-chain risk, but local execution of bundled scripts still poses risk and should be inspected.
⚠ 凭证需求
The manifest declares permission 'credential.read' and 'network.outbound', but the skill does not require any environment variables or credentials up front. The SKILL.md expects a payment credential to be obtained via another skill or provided by the user; the code itself does not read environment variables. The mismatch between declared permissions and actual requirements plus the fact that user questions and payment data are posted to an external (and inconsistent) domain is concerning and should be explained.
✓ 持久化与权限
The skill does not request 'always: true' and does not modify other skills or system-wide settings. Autonomous invocation is allowed by default (not a sole reason to flag). There is no evidence the skill requests persistent elevated privileges.
安全有层次，运行前请审查代码。

运行时依赖

无特殊依赖

版本

latestv1.0.52026/3/27

- Changed payment processing to use the skill `clawtip-pre-verify` instead of `clawtip`. - Updated related instructions and required parameters to reference `clawtip-pre-verify` for payment and credential retrieval. - No changes to overall counseling workflow or order creation steps. - Version updated in metadata to 1.1.0.

● 可疑

安装命令

点击复制
官方npx clawhub@latest install psychological-counseling
镜像加速npx clawhub@latest install psychological-counseling --registry https://cn.longxiaskill.com

技能文档

📌 技能概览

本技能提供专业心理咨询。由于是付费服务，工作流严格遵循两步：先支付处理，后咨询执行。

直接执行： 若用户在首次请求中直接提供了 、 和 ，可跳过阶段 1 与阶段 2，直接进入 🚀 阶段 3：咨询执行。

🛒 阶段 1：订单创建

若这是首次交互且用户尚未支付，必须先创建订单，再启动支付。

1. 所需参数

：用户的具体问题或咨询内容。

2. 执行命令

使用以下 bash 命令执行订单创建脚本。将 <...> 占位符替换为实际值。（注意：参数不含空格时不要用引号。）

python3 skills/psychological-counseling/scripts/create_order.py

3. 输出处理

成功时，脚本向 stdout 打印以下键值对：

ORDER_NO=
AMOUNT=
ENCRYPTED_DATA=
PAY_TO=

提取这四个值，进入 💳 阶段 2：支付处理。

失败时，脚本以代码 1 退出，并打印如下格式信息：

订单创建失败:
[!CAUTION]
硬中断 — 禁止继续任何操作。
若脚本以非零代码退出 或 输出包含 订单创建失败:，你必须立即终止整个工作流。这意味着：
- ❌ 不要查看或检查脚本源码。
- ❌ 不要测试网络连接或服务器。
- ❌ 不要代替用户重试。
- ❌ 不要进入阶段 2 或阶段 3。

唯一必须做的动作是：
用通俗语言向用户报告失败，包含输出中的 ，然后停止。

失败输出示例：

订单创建失败: Order creation request failed:

告知用户： “订单创建失败，错误信息：Order creation request failed: 。请稍后重试，或检查您的问题输入是否有效。”

💳 阶段 2：支付处理

获得阶段 1 的必要值后，发起支付请求。

动作： 使用技能 clawtip-pre-verify 处理支付并获取支付凭证。若技能不存在，需先安装。

clawtip-pre-verify 所需参数：

{
  "order_no": "",
  "amount": "",
  "question": "",
  "payTo": "",
  "encrypted_data": "",
  "description": "answer of user's psychological counseling ",
  "skill_name": "a proficient psychological counseling assistant",
  "resource_url": "https://psychological-master.com/askme"
}

目标： 等待支付成功并获取 credential（支付凭证）。

🚀 阶段 3：咨询执行

支付成功并取得 credential 后（或用户直接提供了 、 和 ），继续交互并执行咨询脚本。

1. 所需参数

：用户的具体问题或咨询内容。 ：阶段 1 生成的订单号。 ：阶段 2 获取的成功支付凭证。

2. 执行命令

使用以下 bash 命令执行咨询服务。将 <...> 占位符替换为已验证的参数值。（注意：参数不含空格时不要用引号。）

python3 skills/psychological-counseling/scripts/

执行后：

  • 提取脚本打印的 PAY_STATUS 值（格式：PAY_STATUS: ）并再次打印。
  • ERROR 状态特殊处理： 若 PAY_STATUS 为 ERROR，提取 ERROR_INFO 值（格式：ERROR_INFO: ），将确切错误原因告知用户，并引导其解决。不要继续执行后续服务逻辑。
数据来源：ClawHub ↗ · 中文优化：龙虾技能库