Huifu DouGong Aggregation Base
v1.0.2汇付支付聚合支付基础的斗拱SDK Skill：公共参数、协议规则、多语言 SDK 入口、Java 适配说明、支付类型和错误码。当开发者首次接入汇付聚合支付或需要了解公共配置时使用。所有聚合支付 Skill 的前置依赖。触发词：聚合支付接入、Lightning SDK、dg-lightning-sdk、聚合支付初始...
⭐ 3· 254·0 current·0 all-time
by青衫墨痕@codecodeing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name, description and files are consistent: the skill is a documentation/adapter base for Huifu's dg-lightning SDK and legitimately requires product id, sys id and RSA keys used for signing/verification. There are no unrelated credentials, binaries, or install steps requested.
Instruction Scope
SKILL.md and referenced docs provide integration guidance, code examples and rules for building payloads, webhook handling and signature verification. The instructions only reference the declared Huifu config values and standard integration endpoints; they do not instruct reading arbitrary host files, sending secrets to unknown endpoints, or performing out-of-scope system inspection.
Install Mechanism
Instruction-only skill (no install spec, no archives or downloads). SDK installation is documented as a standard Maven dependency (dg-lightning-sdk), which is appropriate for the stated Java examples. No network installs from untrusted URLs are included in the skill bundle.
Credentials
The skill requires sensitive RSA private/public keys and product/sys identifiers — these are proportional and expected for a payment SDK. Treat the private key as high-sensitivity: follow the skill's guidance (use env injection, do not hardcode, avoid logging).
Persistence & Privilege
No install-time persistence, not always-included, and no self-enabling or modification of other skills' configs. The skill is a passive documentation base and does not request elevated platform privileges.
Assessment
This skill is a documentation/adapter for Huifu's dg-lightning payment SDK and appears internally consistent. Before installing: 1) Confirm you obtained the skill from a trusted source (the homepage points to Huifu's official docs); 2) Protect the HUIFU_RSA_PRIVATE_KEY (use environment injection or a secret manager, avoid logging or storing it in source control); 3) During development use test/offline keys and not production keys; 4) Verify any downstream business skills that depend on this base do not leak or reprint secrets and that your notify_url/webhook endpoints are hardened (HTTPS, proper verification, and correct port exposure). If you need stronger assurance, ask the publisher for provenance of the packaged skill and verify the dg-lightning-sdk Maven artifact coordinates in your own build environment.Like a lobster shell, security has layers — review code before you run it.
latestvk975nahq489s9chnb2bmwqsgmn84vrch
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
ConfigHUIFU_PRODUCT_ID, HUIFU_SYS_ID, HUIFU_RSA_PRIVATE_KEY, HUIFU_RSA_PUBLIC_KEY