AI春联

AI春联生成专家，根据用户提供的场景、氛围或关键词，生成富有意境的春联。这是一项付费服务，实际收款方可通过配置文件自定义。请注意，你应该用中文和用户交互（包含你的思考过程）。

Security Scan

The skill mostly does what it claims (paid spring-couplet generation) but contains multiple inconsistencies and over-broad instructions (including asking the model to reveal its thought process), and its codebase appears reused/incorrect in places — review before installing or trusting with secrets.

Purpose & Capability

The stated purpose (生成春联并按付费流程交付) matches the presence of order creation, payment-credential verification (SM4 encrypt/decrypt) and generation scripts. However there are odd mismatches: hard-coded slug and saved 'skill-id' values in code ('ai-chunlian-v2' and 'si-clawpraise') and copy-paste descriptions ('花式夸夸服务费用') that don't align with the skill name/metadata, suggesting the code was repurposed. SKILL.md requests 'network.outbound' and 'credential.read' permissions; the bundled scripts themselves operate locally (filesystem + sqlite + local config + crypto) and do not perform outbound network calls, though the payment step delegates to an external skill ('clawtip') which might need network. Overall capability is plausible but there are coherence issues that merit caution.

Instruction Scope

The runtime instructions contain multiple problems: (1) SKILL.md explicitly instructs the agent to interact in Chinese and to include its internal thinking process ('包含你的思考过程') — this asks for chain-of-thought output and is inappropriate/overbroad. (2) The documented execution command for chunlian_generate.py provides only <订单号>, but the script's usage requires two arguments (<order_no> <indicator>), so the SKILL.md instructions are inconsistent and will likely cause failures. (3) SKILL.md declares permissions like 'credential.read' and 'network.outbound' and a 'payment.process' capability, but the bundled scripts do not themselves perform network calls — payment is delegated to another skill; this mismatch should be clarified. (4) The guidance to always quote parameters to avoid injection is good, but the agent will be executing local Python scripts on the host filesystem (reads/writes under user home), so be aware of that surface.

Install Mechanism

No install spec (instruction-only skill) and the code files are bundled with the skill. There are no remote downloads or package installs declared. Risk from install mechanism is low, but the agent executing included scripts will run Python code that reads and writes files in the user's home directory.

Credentials

The skill requests credential.read permission and expects configuration files under the user's home (configs/config.yaml and configs/config.json containing SM4 keys and a pay_to value). That is proportionate for a local, encrypted payment flow. However: (1) there are two different SM4 keys in the two config files (in config.json and config.yaml) which is confusing, (2) the configs bundled with the skill already contain secrets (sm4 keys and a very long payTo value) — shipping prepopulated secrets is suspicious practice, (3) the skill does not require any environment variables but reads configuration files from predictable user paths (~/.hermes/... and ~/.openclaw/...), so installing it grants the skill access to local config and order files. Consider whether you trust this skill with local secrets.

Persistence & Privilege

The skill does not request always:true and does not attempt to modify other skills. It creates/updates files and an SQLite DB under user home (~/.openclaw... and ~/.hermes...), which is expected for order storage but is persistent. This is normal for a payment/order workflow but gives the skill ongoing local state.

What to consider before installing

This skill implements a paid spring-couplet workflow using local order files, an SQLite DB, and SM4 encryption. Before installing or using it: 1) Do NOT provide secrets (API keys, real merchant credentials) until you verify the code; the skill reads config files from predictable paths and those files contain SM4 keys and pay addresses. 2) The SKILL.md asks the model to reveal its internal thought process — refuse or remove any instruction that requests chain-of-thought. 3) There are several inconsistencies in the files (missing/incorrect CLI arguments, mismatched 'slug' and 'skill-id', differing SM4 keys in configs) — ask the maintainer to fix these or review the code yourself. 4) Confirm where payment is actually processed: the skill delegates to a 'clawtip' skill; verify that skill separately and confirm any network calls and endpoints it uses. 5) If you will run the bundled Python scripts, review them locally (they run under your user account and will create files under ~/.openclaw and ~/.hermes). If you lack the ability to audit the code, treat this skill as untrusted for handling real payments or secrets.

AI春联生成服务

📌 技能概述

请注意，你应该用中文和用户交互（包含你的思考过程）。

本技能提供专业的春联生成服务。由于这是付费服务，工作流程严格要求按照两个步骤执行：支付处理 后，再进行 春联生成。

收款方配置： 实际收款方信息在 configs/config.json 中配置，包括商户ID（payTo）等信息。

直接执行： 如果用户在初始请求中已直接提供了 <订单号>（且订单文件中已包含 payCredential），则可跳过第一阶段和第二阶段，直接进入 🚀 第三阶段：春联生成。

---

⚙️ 配置说明

首次使用前，请编辑 configs/config.json 文件，配置您的收款方信息：

{
  "payTo": "您的商户ID",
  "amount": 1,
  "skillName": "ai-chunlian",
  "description": "春联生成服务费用"
}

• payTo: 您的商户ID（必填）
• amount: 收费金额，单位为分（默认1分=0.01元）
• skillName: 技能名称（用于计算indicator）
• description: 订单描述

---

🛒 第一阶段：创建订单

如果这是首次交互且用户尚未付款，你必须先创建订单，再发起支付。

1. 所需参数

• <场景描述>：描述春联的使用场景（例如：春节大门、乔迁新居、开业大吉等）

2. 执行命令

使用以下 bash 命令执行订单创建脚本。将 <...> 占位符替换为实际值。务必在参数两侧加引号，以防命令注入漏洞。

python3 scripts/create_order.py "<场景描述>"

3. 输出处理

成功时，脚本将向标准输出打印以下键值对：

ORDER_NO=<值>
AMOUNT=<值>
QUESTION=<值>
INDICATOR=<值>

其中 ORDER_NO、AMOUNT 和 QUESTION 用于向用户披露订单信息（展示订单号、费用和查询内容）。提取 ORDER_NO 和 INDICATOR 后进入 💳 第二阶段：支付处理。

[!NOTE] 关于 AMOUNT 字段： 该字段的单位为人民币分（fen），这是 OpenClaw 技能描述中的标准计费单位。例如，AMOUNT=1 表示需支付 0.01 元人民币。在向用户展示费用时，请将该值除以 100 并以"元"为单位呈现，以便用户理解实际支付金额。

失败时，脚本以退出码 1 退出，并打印如下格式的消息：

订单创建失败: <错误详情>

---

💳 第二阶段：支付处理

从第一阶段获取 ORDER_NO 和 INDICATOR 后，发起支付请求。

操作： 使用技能 clawtip 处理支付并获取支付凭证。若该技能不存在，需先安装。

调用 clawtip 所需参数：

{
  "order_no": "<第一阶段获取的 ORDER_NO>",
  "indicator": "<第一阶段获取的 INDICATOR>"
}

目标： 等待支付成功，并获取 payCredential（支付凭证）。

---

🚀 第三阶段：春联生成

支付成功并获得 payCredential 后（或用户已直接提供 <订单号> 和 <支付凭证>），继续交互并执行春联生成脚本。

1. 所需参数

• <订单号>：第一阶段生成的订单号。

2. 执行命令

使用以下 bash 命令执行春联生成服务。将 <...> 占位符替换为已验证的参数值。务必在参数两侧加双引号，以防命令注入漏洞。

python3 scripts/chunlian_generate.py "<订单号>"

执行后： 1. 提取脚本打印的 PAY_STATUS 值（格式为：PAY_STATUS: <值>），并再次输出展示。 2. ERROR 状态的特殊处理： 如果 PAY_STATUS 为 ERROR，提取 ERROR_INFO 值（格式：ERROR_INFO: <值>），向用户告知确切的错误原因并引导其解决。不得继续执行后续服务逻辑。