SKILLEMALL.ai
GitHub ↗ RU Sign in

CF huifu-merchant-onboarding

汇付支付/斗拱支付（Huifu Payment）商户进件、开户、KYC 与商户管理（Merchant Onboarding）。用于企业、个体工商户、小微商户或无执照个人的入驻、入网和实名认证，以及营业执照、法人、结算卡、股东、联系人、门店等资料和图片上传，涉及 file_url、file_id、huifu_id、apply_no 或 upper_huifu_id 的请求；也用于企业用户或个人用户开户、用户业务入驻、用户申请单状态和用户信息查询，以及微信、支付宝、银联、银行卡、快捷、网银、分账、代扣、余额、预授权、补贴、合单等业务的开通、补开、业务开通修改或配置修改，以及商户资料、基本信息修改、商户详情、结算信息、费率查询、申请状态、审核、实名、绑卡、电子协议和商户状态变更。支持完整字段/DTO/响应、必填条件、类型长度、枚举、Java/PHP/Python SDK、请求头、签名验签、短信验证、权限、补资料、状态延迟，以及审核、业务和电子协议通知排障。实际支付下单、查单、关单、退款、对账、收银台组件 checkout-js、支付通知或支付终态使用 huifu-pay-integration；开户开通后继续发起支付的端到端请求同时使用 huifu-merchant-onboarding 和 huifu-pay-integration。

ClawHub Agent Skills author: Huifu v1.0.2 MIT-0 54 files body ≈ 3 365 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

汇付支付/斗拱支付（Huifu Payment）商户进件、开户、KYC 与商户管理（Merchant Onboarding）。用于企业、个体工商户、小微商户或无执照个人的入驻、入网和实名认证，以及营业执照、法人、结算卡、股东、联系人、门店等资料和图片上传，涉及…

As a process F 33/100 · Will not run — References files that are not bundled: references/merchant-onboarding-complete-field-catalog.md

IntegrationSoftware developmenttype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
C
61/100
safety, quality, tests
Safety 60%
58
Quality 40%
66
Run on models
none yet
Process rating
F
33/100
Will not run
References files that are not bundled: references/merchant-onboarding-complete-field-catalog.md
Tools and files w 18
0
Result and completion w 14
0
Inputs and preconditions w 11
0
the three weakest of ten parameters · all ten

How to improve

  1. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
  2. The text references files that are not there: add them or drop the references.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 42

✓ No critical or high findings

Medium and low: 42
  • low Secrets in code secret-high-entropy-token references/canonical-regression-prompts.md:147
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    期望：路由到商户多费率配置；请求 `wx_conf_list/ali_conf_list` 各按 String(JSON Array) 编码且不能同时为空；响应 `conf_list:String` 缺少对象/数组编码说明，生产解析前硬停确认；三语言均使用 `V2Me…est`，扩展映射不得覆盖定位字段；只允许 `A/W`，禁止旧版 `T`。
    quoted
  • low Secrets in code secret-high-entropy-token references/canonical-regression-prompts.md:155
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    期望：路由到商户多费率配置查询；请求共8节点、响应共9节点，`conf_list:String` 挂载四个子字段但缺少对象/数组编码说明，生产解析前硬停确认；三语言均使用 `V2Me…est`，`fee_sign` 通过 exact-key 扩展传入且不得覆盖三个声明字段；使用 `W=微信`，也不承诺省略 `fee_sign` 后返回全部。
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-application-status-query.md:33
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    Java `3.0.40`、PHP `2.0.30`、Python `2.0.24` 都有 `V2Me…est` 作为可选封装，字段定位到 `req_seq_id`、`req_date`、`apply_no`、`huifu_id`。Python 不会自动生成 `req_seq_id` / `req_date`；三个 SDK 的默认同步验签路
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-basic-info-modify.md:44
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Java / PHP：`V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-basic-info-modify.md:45
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Python：`V2Me…est`，模块 `v2_merchant_basicdata_modify_request.py`
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-detail-query.md:41
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    Java `3.0.40`、PHP `2.0.30`、Python `2.0.24` 都有 `V2Me…est` 作为可选封装，字段仅定位到 `req_seq_id`、`req_date`、`huifu_id`。调用方必须为本次查询生成新的当天唯一流水；SDK 默认响应验签路径不等于允许保存完整响应。
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-enterprise.md:27
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Java `V2Me…est` 没有该扩展字段的专属 setter 时，必须通过 `extendInfoMap` 原名透传，禁止改名：
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-enterprise.md:50
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    Java `3.0.40`、PHP `2.0.30`、Python `2.0.24` 都有 `V2Me…est` 作为可选封装，但三个锁定版本均没有 `material_card_info` 或新 `head_type` 的专属字段/setter。使用各语言 Request 的 exact-key 扩展字段能力时，键必须保持 `material_card_
    quoted
  • low Obfuscation obf-hex-escape-chain references/merchant-onboarding-external-resources.md:88
    Escaped/char-code string obfuscation (documentation table row)
    | 基本信息修改 `request.data.card_info.auth_entrust_pic` | 授权结算委托书模板（DOCX） | `https://cloudpnrcdn.oss-cn-shanghai.aliyuncs.com/opps/api/prod/download_file/kyc/12%E3%80%90%E5%95%86%E6%88%B7%E3%80%91%E6%8E%88
    table
  • low Obfuscation obf-hex-escape-chain references/merchant-onboarding-external-resources.md:90
    Escaped/char-code string obfuscation (documentation table row)
    | 业务开通修改 `request.data.extended_material_list`；分账能力修改 | 分账功能提供材料（XLSX） | `https://cloudpnrcdn.oss-cn-shanghai.aliyuncs.com/opps/api/prod/download_file/kyc/KYC-%E5%88%86%E8%B4%A6%E5%8A%9F%E8%83%BD%E6%8
    table
  • low Obfuscation obf-hex-escape-chain references/merchant-onboarding-external-resources.md:107
    Escaped/char-code string obfuscation (documentation table row)
    | `data.online_busi_type`；开通快捷、网银、余额支付 Pro、银行大额转账、分账比例大于 30% 或代扣 | 线上业务类型编码及补充材料说明（XLSX） | `https://cloudpnrcdn.oss-cn-shanghai.aliyuncs.com/opps/api/prod/download_file/kyc/KYC-%E7%BA%BF%E4%B8%8A%E4%B
    table
  • low Obfuscation obf-hex-escape-chain references/merchant-onboarding-external-resources.md:108
    Escaped/char-code string obfuscation (documentation table row)
    | `data.extended_material_list`；纸质协议或 `data.agreement_info` | 商户合同签约规则 / 签约协议材料说明（XLSX） | `https://cloudpnrcdn.oss-cn-shanghai.aliyuncs.com/opps/api/prod/download_file/kyc/KYC-%E5%95%86%E6%88%B7%E5%90
    table
  • low Obfuscation obf-hex-escape-chain references/merchant-onboarding-external-resources.md:109
    Escaped/char-code string obfuscation (documentation table row)
    | `data.extended_material_list`；余额支付 | 余额支付补充材料（XLSX） | `https://cloudpnrcdn.oss-cn-shanghai.aliyuncs.com/opps/api/prod/download_file/kyc/KYC-%E4%BD%99%E9%A2%9D%E6%94%AF%E4%BB%98%E8%A1%A5%E5%85%85%E6%
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-image-upload.md:34
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | Java `dg-java-sdk 3.0.40` | 有 `V2Su…est`、`V2_S…URE`、`BasePayClient.upload(...)`；无文件时对该 URI 特判为 multipart 文本字段，有文件时以 `file` 为 multipart 文件字段；两条路径都先对 `data` 加签 | 支
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-image-upload.md:56
    High-entropy token-like string (may be an id, hash or a credential)
    V2Su…est request = new V2Su…est();
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-image-upload.md:83
    High-entropy token-like string (may be an id, hash or a credential)
    V2Su…est request = new V2Su…est();
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-individual.md:26
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Java `V2Me…est` 没有该扩展字段的专属 setter 时，通过 `extendInfoMap.put("async_return_url", ...)` 原名透传；禁止把 `notify_url` 作为扩展字段键。
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-individual.md:41
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    Java `3.0.40`、PHP `2.0.30`、Python `2.0.24` 都有 `V2Me…est` 作为可选封装。它只证明 URI、字段序列化和 SDK 默认的请求/同步响应处理路径；主体判断、材料条件和渠道准入仍以本页和官方联调为准。每次调用显式传入新的当天唯一 `req_seq_id` / `req_date`，Python 不会自动生
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-multifee-config.md:43
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | Java | `V2Me…est` | `V2_M…FIG = v2.m…fig` | `setExtendInfo(Map<String, Object>)`，配置值使用已序列化的 JSON Array 字符串。 |
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-multifee-config.md:44
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | PHP | `V2Me…est` | `V2_M…FIG = v2/merchant/busi/multiFee/config` | `setExtendInfo(array)`，配置值使用 JSON Array 字符串。 |
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-multifee-config.md:45
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | Python | `V2Me…est` / `v2_merchant_busi_multifee_config_request.py` | `V2_M…FIG = /v2/merchant/busi/multiFee/config` | `post(extend_infos)`，配置值使用 J
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-multifee-query.md:33
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | Java | `V2Me…est` | `V2_M…ERY = v2.m…ery` | `setExtendInfo(Map<String, Object>)`，使用 exact key `fee_sign`。 |
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-multifee-query.md:34
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | PHP | `V2Me…est` | `V2_M…ERY = v2/merchant/busi/multiFee/query` | `setExtendInfo(array)`，使用 exact key `fee_sign`。 |
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-multifee-query.md:35
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | Python | `V2Me…est` / `v2_merchant_busi_multifee_query_request.py` | `V2_M…ERY = /v2/merchant/busi/multiFee/query` | `post(extend_infos)`，使用 exact ke
    table
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-sms-send.md:35
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Java / PHP：`V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-sms-send.md:36
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Python：`V2Me…est`，模块 `v2_merchant_basicdata_sms_send_request.py`
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-status-change.md:41
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Java / PHP：`V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/merchant-onboarding-status-change.md:42
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - Python：`V2Me…est`，模块 `v2_merchant_busi_modify_busistatus_request.py`
    quoted
  • low Secrets in code secret-high-entropy-token references/shared-server-sdk-matrix.md:27
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - `V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/shared-server-sdk-matrix.md:28
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - `V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/shared-server-sdk-matrix.md:30
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - `V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/shared-server-sdk-matrix.md:31
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - `V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/shared-server-sdk-matrix.md:33
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - `V2Me…est`
    quoted
  • low Secrets in code secret-high-entropy-token references/user-onboarding-canonical-regression-prompts.md:107
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    预期：路由 `/v2/user/basicdata/ent/modify`，使用 `V2Us…est`；`huifu_id` 使用企业用户号；法人证件四个类型/有效期字段同步填写，外国人居留证触发国籍；`file_list` 发送 String(JSON Array)；指出生成类只声明四个字段且扩展后合并会覆盖定位字段，拒绝扩展中的 `req_date
    quoted
  • low Secrets in code secret-high-entropy-token references/user-onboarding-canonical-regression-prompts.md:113
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    预期：路由 `/v2/user/basicdata/indv/modify`，使用 `V2Us…est`；`huifu_id` 使用个人用户号；`cert_validity_type` 只允许正式枚举0/1，当前示例1有效；`file_list` 发送 String(JSON Array)，子项 `file_id/file_name` 长度为64；当
    quoted
  • low Secrets in code secret-high-entropy-token references/user-onboarding-detail-query.md:50
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    官网未声明异步通知。三语言专属类为 `V2Us…est`；不得与 `V2Me…est` 混用。
    quoted
  • low Secrets in code secret-high-entropy-token references/user-onboarding-enterprise-modify.md:28
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    Java `3.0.40`、PHP `2.0.30`、Python `2.0.24` 均使用 `V2Us…est`，精确路由为 `/v2/user/basicdata/ent/modify`。三语言生成类只显式声明 `req_date`、`req_seq_id`、`huifu_id`、`legal_cert_nationality`；其余官方可选字段通
    quoted
  • low Secrets in code secret-high-entropy-token references/user-onboarding-field-contracts.md:56
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - 三语言 `V2Us…est` 只声明四个字段；其他正式请求字段通过 exact-key 扩展。扩展后合并能覆盖声明字段，因此接入层必须拒绝覆盖 `req_date/req_seq_id/huifu_id/legal_cert_nationality`，并对扩展使用正式请求字段白名单。
    quoted
  • low Secrets in code secret-high-entropy-token references/user-onboarding-field-contracts.md:66
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    - 三语言 `V2Us…est` 只声明 `req_date/req_seq_id/huifu_id`；其他正式请求字段通过 exact-key 扩展。扩展后合并能覆盖声明字段，因此拒绝覆盖这三个键，并对扩展使用正式请求字段白名单。
    quoted
  • low Secrets in code secret-high-entropy-token references/user-onboarding-individual-modify.md:30
    High-entropy token-like string (may be an id, hash or a credential)
    Java 3.0.40、PHP 2.0.30、Python 2.0.24 都使用 V2Us…est，精确路由 /v2/user/basicdata/indv/modify。三语言生成类恰好只声明 req_seq_id/req_date/huifu_id；其余14个正式请求字段通过 exact-key 扩展映射传入。
  • low Secrets in code secret-high-entropy-token references/user-onboarding-shared-server-sdk-matrix.md:24
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | `V2Us…est` | `/v2/user/basicdata/ent/modify` |
    table
  • low Secrets in code secret-high-entropy-token references/user-onboarding-shared-server-sdk-matrix.md:25
    High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
    | `V2Us…est` | `/v2/user/basicdata/indv/modify` |
    table

Files scanned: 54. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning description-no-when description does not say WHEN to use the skill (no "use when")
  • warning missing-ref reference to a missing file: references/merchant-onboarding-complete-field-catalog.md

Process rating: all ten parameters 33/100

Will not run. References files that are not bundled: references/merchant-onboarding-complete-field-catalog.md
  • 0Tools and files. 1 referenced file(s) missing: references/merchant-onboarding-complete-field-catalog.md
  • 0Result and completion. Does not say what the result is
  • 0Inputs and preconditions. Does not say what the process needs to start
  • 0Failures and branches. Linear process with no failure handling
  • 0Progress reporting. Says nothing while it works
  • 20When it triggers. No condition that starts the skill
  • 30Running it twice. 1 mutating operations with no state check
  • 100Steps. 58 steps
  • 100Consistency. Name and required fields are in place
  • 100Execution cost. Instruction body is 3365 tokens
  • low 11 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Output format is not stated: the model decides each time
  • +4No input/output examples
  • +1No license
  • +2Single-language instructions
  • +3Description length 574: enough signal without eating the budget
  • +4Structure: 13 headings
  • +3Step-by-step instructions: 58 items
  • +4Reference files are cited in the instructions (51 of 51)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 66.

External checks

ClawHub: clean
This skill is a Huifu onboarding integration guide for sensitive merchant and user workflows, but its behavior is disclosed, scoped, and guarded by confirmation and credential-safety rules.
LLM: benign (high) · VirusTotal: · 31 Aug 2026