Huifu DouGong Aggregation Refund
v1.0.2汇付支付聚合支付退款的斗拱SDK Skill：覆盖聚合交易退款和退款结果查询。参数表和业务规则按协议字段组织，Java SDK 调用方式放在语言适配入口里。当开发者需要对聚合支付订单发起退款或查询退款状态时使用。触发词：聚合退款、聚合退款申请、聚合退款查询、聚合退款状态。
⭐ 3· 259·0 current·0 all-time
by青衫墨痕@codecodeing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Huifu aggregation refund) align with what the skill asks for: product_id, sys_id, RSA keys and a notify_url are typical and required for calling Huifu refund/refund-query APIs and producing signatures.
Instruction Scope
SKILL.md restricts actions to refund and refund-query protocol, SDK usage, and integration notes; it does not instruct reading unrelated system files or exfiltrating data. It references a base skill for initialization — review that base skill before use.
Install Mechanism
No install spec and no code files are present (instruction-only), so nothing is downloaded or written to disk by the skill itself.
Credentials
The skill requests access to HUIFU_PRODUCT_ID, HUIFU_SYS_ID, HUIFU_RSA_PRIVATE_KEY, HUIFU_RSA_PUBLIC_KEY, and HUIFU_REFUND_NOTIFY_URL (declared as config paths). These are proportionate to a payment integration, but HUIFU_RSA_PRIVATE_KEY is highly sensitive — ensure it is provisioned securely and not exposed to logs or other skills.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent presence or claim ability to modify other skills. Autonomous invocation is allowed (platform default) and appropriate for an integration skill.
Assessment
This skill appears coherent for integrating Huifu refund APIs. Before installing: 1) Confirm the referenced base skill (huifu-dougong-aggregation-base) is trustworthy because it performs SDK init and may perform network calls; 2) Provision HUIFU_RSA_PRIVATE_KEY and other config values in a secure vault (do not store them in plain text); 3) Ensure your refund notify_url points to an endpoint you control and that the agent will not leak private keys in logs; 4) Verify the homepage/contact details (paas.huifu.com and the provided support channels) match your expectations; 5) Because the skill is instruction-only, there is no code to inspect beyond the docs — if you need stronger assurance, ask the publisher for a published package or signed SDK and inspect the base-skill implementation.Like a lobster shell, security has layers — review code before you run it.
latestvk97d918a1sa2vg8tz65k7d2wgx84v86z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
ConfigHUIFU_PRODUCT_ID, HUIFU_SYS_ID, HUIFU_RSA_PRIVATE_KEY, HUIFU_RSA_PUBLIC_KEY, HUIFU_REFUND_NOTIFY_URL