ClawHub

Huifu DouGong HostingPay Checkout JS

v1.0.0

汇付支付托管支付前端收银台 JS SDK Skill：覆盖 @dg-elements/js-sdk 安装、HFPay 初始化、checkout 组件、单支付按钮、createPreOrder 约定、pre_order_type 映射和回调处理。当开发者需要在 H5/PC 页面集成汇付托管收银台前端能力时使用。触发...

⭐ 0· 40·0 current·0 all-time
by青衫墨痕@codecodeing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the content: this is a front-end SDK integration guide for Huifu hosting-pay checkout. Declared config keys (HUIFU_PROJECT_ID, HUIFU_PROJECT_TITLE, HUIFU_CALLBACK_URL) are reasonable for a front-end integration and no unrelated credentials or binaries are requested.
✓
Instruction Scope
SKILL.md only instructs front-end integration steps: installing the npm SDK, initializing HFPay, providing a createPreOrder callback that calls the merchant's server, mounting components, and sending minimal callback data to the merchant backend. It explicitly warns not to store private keys in the browser and keeps service-side responsibilities (preorder, signing, final query) on the server. There are no instructions to read unrelated files, collect system secrets, or call unexpected external endpoints.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files—no downloads or archives to write to disk. The SDK install mentioned is the official npm package (@dg-elements/js-sdk), which is appropriate and expected for the purpose.
✓
Credentials
Only config entries are required (project id / title / callback URL) which are proportional to a front-end checkout integration. No sensitive environment variables (private keys, tokens) are requested. The documentation explicitly disallows storing RSA private keys in the browser.
✓
Persistence & Privilege
Skill does not request permanent or elevated platform privileges (always:false). It is user-invocable and can be invoked by the agent like other skills, which is the normal platform behavior.
Assessment
This is a documentation-only skill describing how to integrate Huifu's front-end checkout JS SDK. Before using: (1) ensure you fetch the SDK from the official registry (verify package name/version and integrity), (2) keep all signing keys and server-side preorder/query logic on your backend as the docs recommend, (3) implement the /api endpoints the guide calls (createPreOrder and order-confirm) and validate inputs on the server, and (4) confirm the project_id and callback_url values are correct for your merchant project. No code is shipped by the skill itself, so the security of your integration depends on your backend and the actual SDK package you install.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dcjyedcna5d93zqkvthsk2584vbxb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

ConfigHUIFU_PROJECT_ID, HUIFU_PROJECT_TITLE, HUIFU_CALLBACK_URL

Comments