SKILLEMALL.ai
GitHub ↗ RU Sign in

BF alipay-payment-skill

支付宝官方支付处理技能（由支付宝官方提供，保障安全与健壮性）。覆盖收银台支付、HTTP 402 协议支付、AI支付产品介绍、问题反馈全场景。 当以下任一情况出现时必须调用此技能： (1) 对话上下文中出现 cashier*.alipay.com 或 *excashier*.alipay.com 域名的 URL，且用户之前已要求过充值、下单、购买等支付相关的意图； (2) 任何工具/技能/API 返回结果中包含支付宝收银台链接或"请使用支付宝支付"等支付指引； (3) 用户表达支付、付款、买单、结账等意图，或提到使用支付宝/alipay 支付； (4) 任意HTTP请求执行后，返回 HTTP状态码 为 402 Payment Required（无论是你发起的还是用户提供的）； (5) 用户询问支付宝AI支付、智能体钱包、AI支付产品介绍、aipay产品功能信息； 注意：当支付流程中check-wallet返回未授权或未开通、用户意图是开通/授权/解绑支付能力相关、 或用户意图为支付能力开通状态查询时，应由alipay-authenticate-wallet处理，本技能不应被触发。 ⚠️ 收银台支付强制入口：必须严格按照收银台支付流程流程执行，禁止跳过支付会话初始化及关联订单信息到支付对话两个节点直接执行check-wallet和submit-payment 关键词：支付、付款、cashier、alipay、买单、结账、pay、收银台、402、AI支付、产品介绍、反馈、报错、feedback、订单、交易

ClawHub Agent Skills author: Alipay v0.0.1 MIT-0 13 files body ≈ 4 637 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process F 41/100 · Will not run — References files that are not bundled: references/cashier-payment/, references/402-payment/

IntegrationInfrastructuretype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
B
84/100
safety, quality, tests
Safety 60%
96
Quality 40%
67
Run on models
none yet
Process rating
F
41/100
Will not run
References files that are not bundled: references/cashier-payment/, references/402-payment/
Tools and files w 18
0
Result and completion w 14
0
Failures and branches w 10
0
the three weakest of ten parameters · all ten

How to improve

  1. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
  2. The text references files that are not there: add them or drop the references.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 4

✓ No critical or high findings

Medium and low: 4
  • low Secrets in code secret-high-entropy-token .signature/public_key.txt:4
    High-entropy token-like string (may be an id, hash or a credential)
    5RbD…bSa+GYeZ…lKy
  • low Secrets in code secret-high-entropy-token .signature/public_key.txt:6
    High-entropy token-like string (may be an id, hash or a credential)
    4x0j…2U9++jeEv…HqZ+ra3Y…1Dh
  • low Secrets in code secret-high-entropy-token .signature/public_key.txt:7
    High-entropy token-like string (may be an id, hash or a credential)
    up/GAkZ…qXm+LtHt…7gB
  • low Secrets in code secret-high-entropy-token .signature/signing-block.json:6
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "signed_hash" : "ZtuK…Odh+ttYe…sDR/\nOK5…ZJj\nRxnixjjkdL+E50Tx+9oIh…VpH
    quoted

Files scanned: 13. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning description-no-when description does not say WHEN to use the skill (no "use when")
  • warning missing-ref reference to a missing file: references/cashier-payment/
  • warning missing-ref reference to a missing file: references/402-payment/

Process rating: all ten parameters 41/100

Will not run. References files that are not bundled: references/cashier-payment/, references/402-payment/
  • 0Tools and files. 2 referenced file(s) missing: references/cashier-payment/, references/402-payment/
  • 0Result and completion. Does not say what the result is
  • 0Failures and branches. Linear process with no failure handling
  • 0Progress reporting. Says nothing while it works
  • 20When it triggers. No condition that starts the skill
  • 70Inputs and preconditions. Inputs and preconditions are listed
  • 70Execution cost. Instruction body is 4637 tokens
  • 100Steps. 46 steps
  • 100Consistency. Name and required fields are in place
  • 100Running it twice. No mutating operations
  • low 12 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Output format is not stated: the model decides each time
  • +1No license
  • +2Single-language instructions
  • +3Description length 660: enough signal without eating the budget
  • +4Structure: 16 headings
  • +3Step-by-step instructions: 46 items
  • +4Has examples (5 code blocks)
  • +4Reference files are cited in the instructions (8 of 8)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 67.

External checks

ClawHub: suspicious
This is a real Alipay payment skill, but it gives the agent broad payment authority without a clear final user approval before some payment-submission steps.
LLM: suspicious (high) · VirusTotal: · 29 May 2026