by 安全扫描
OpenClaw
可疑
medium confidenceThe SKILL.md matches its stated purpose (querying Huifu orders) but omits practical requirements (merchant credentials) and fails to declare that Maven is needed; the skill is instruction-only with no install, but these omissions are inconsistent and warrant caution.
评估建议
This skill appears to be a straightforward instruction for adding a Huifu order-query implementation, but it omits two practical (and security-relevant) items: 1) it tells you to run Maven (mvn) yet the skill metadata lists no required binaries — confirm your environment has Maven installed before relying on these instructions; 2) it never specifies how to provide merchant credentials or keys (MerConfig), though the SDK will need them — verify where your project stores those secrets (environment...详细分析 ▾
ℹ 用途与能力
The name/description and the instructions consistently describe a Huifu (汇付) order query helper using the dg-java-sdk. Requesting the sdk dependency and showing API path/parameters is coherent with the stated purpose. However, the skill does not declare the practical runtime needs (merchant credentials / config) that the SDK and MerConfig will require.
ℹ 指令范围
The SKILL.md stays focused on implementing the query endpoint and only asks the developer to check pom.xml, add the dg-java-sdk dependency, run Maven, import SDK classes, and call the Huifu API. It does not instruct reading unrelated system files or exfiltrating data. It does, however, leave out any guidance about handling the merchant credentials/keys that MerConfig will need, which is an important omission.
✓ 安装机制
This is an instruction-only skill with no install spec or supplied code files, so nothing will be downloaded or written by the skill itself. That is the lowest install risk.
⚠ 凭证需求
requires.env is empty, yet the instructions refer to MerConfig and merchant parameters (huifuId) — in practice the SDK needs merchant credentials, keys, and endpoint configuration. The skill does not declare any environment variables or configuration paths for secrets (merchant ID, API keys, private keys, certs), which is disproportionate or incomplete.
✓ 持久化与权限
always is false and there is no install behavior or claims of modifying other skills or system-wide settings. The skill does not request persistent privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.62026/3/13
- Removed the section referencing example code files from documentation - Improved overall documentation formatting and clarity - No functional or interface changes made in this version
● 无害
安装命令 点击复制
官方npx clawhub@latest install huifu-order-query
镜像加速npx clawhub@latest install huifu-order-query --registry https://cn.clawhub-mirror.com
技能文档
# 汇付订单查询接口
引导词
当开发者提到以下关键词时，本技能将被触发：- 订单查询、支付查询、查询订单
- /hfpay/queryorderinfo
- 汇付订单状态、支付状态查询
- 托管支付查询
前置检查（重要）
在开始编写代码之前，必须先检查项目是否已安装汇付SDK依赖。步骤1：检查依赖
检查项目的 pom.xml 文件中是否包含dg-java-sdk 依赖：
``xml
com.huifu.bspay.sdk
dg-java-sdk
${dg-java-sdk.version}
`
步骤2：安装依赖（如未安装）
如果项目中没有该依赖，需要先在 pom.xml 中添加上述依赖，然后执行 Maven 安装：
`bash
mvn clean install
`
或在 IDE 中刷新 Maven 项目。
步骤3：验证依赖
确认以下类可以正常导入：
com.huifu.bspay.sdk.opps.core.BasePay
com.huifu.bspay.sdk.opps.core.配置.MerConfig
com.huifu.bspay.sdk.opps.core.net.BasePayRequest
com.huifu.bspay.sdk.opps.core.utils.DateTools
com.huifu.bspay.sdk.opps.core.utils.SequenceTools
只有完成以上前置检查后，才能继续按照 reference 目录中的示例代码进行开发。
接口说明
| 属性 | 值 |
|-----|-----|
| 接口路径 | /hfpay/queryorderinfo |
| 请求方式 | POST |
| Content-Type | application/json |
| 汇付API端点 | v2/trade/hosting/payment/queryorderinfo` |
功能说明
查询订单支付状态和详细信息，包括交易状态、金额、时间等。请求参数
| 参数名 | 类型 | 必填 | 说明 | |-------|------|-----|------| | huifuId | String | 是 | 商户号 | | org_req_date | String | 是 | 原交易请求日期（格式：yyyyMMdd） | | org_req_seq_id | String | 是 | 原交易请求流水号 |实现步骤
- 初始化商户配置（MerConfig）
- 组装请求参数（包含原交易信息）
- 调用汇付API
- 返回结果
注意事项
- 需要传入原交易的请求日期和请求流水号
- 可用于确认支付状态后再进行业务处理
- 建议在异步通知处理时同步调用查询接口进行二次确认
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制