a2a-Market-ACP-Lite-Negotiation

One-call ACP negotiation skill with executable CLI entrypoint. Accept role/product/price-policy inputs, call gateway backend, and return process plus final r...

Security Scan

The skill's code and runtime instructions match its stated purpose (one-call negotiation via a gateway); it makes only the network calls described and asks for no disproportionate credentials or installs.

Purpose & Capability

The name and description claim a CLI-driven negotiation that calls a gateway backend; both SKILL.md and src/cli/index.js implement exactly that (checking /agents/status, POST /sessions/negotiate, optional trace fetch). There are no unrelated binaries, env vars, or config paths requested.

Instruction Scope

Runtime instructions are limited to running the provided Node CLI (or supplying JSON on stdin) and contacting the gateway endpoints described in the doc. The code does not read arbitrary local files or environment variables, nor does it exfiltrate data to unexpected endpoints (it only contacts the gateway URL supplied by the user or default localhost).

Install Mechanism

There is no install spec or external download; this is an instruction-only skill with a single included JS CLI file. Nothing is written to disk beyond normal execution, and no remote install URLs are used.

Credentials

The skill declares no required environment variables or credentials and the code does not access secrets from the environment. It performs network calls to the gateway specified by the user (defaulting to http://127.0.0.1:3085), which is proportionate to its negotiation purpose.

Persistence & Privilege

The skill is not marked always:true and does not attempt to modify other skills or system-wide agent settings. It is user-invocable and runs only when executed.

Assessment

This skill appears coherent and limited to running a CLI that contacts a gateway you specify (default localhost). Before installing or running it: (1) Review or run the included src/cli/index.js in a sandbox to confirm behavior, (2) only point the --gateway to services you trust (do not set it to a remote, untrusted URL because the script will POST negotiation payloads and may fetch traces), and (3) avoid piping sensitive secrets into stdin when invoking the tool. If you need stronger assurance, run the script with network monitoring or in an isolated environment first.

This skill is executable and backend-connected.

Entrypoint

Run from skill directory:

node src/cli/index.js --role buyer --counterparty-agent-id seller-openclaw --product "mechanical keyboard" --list-amount-minor-units 9000 --currency USD --max-rounds 5 --goal "尽量压价但可成交" --floor-minor-units 7200 --gateway http://127.0.0.1:3085

Also supports stdin JSON input.

Input Parameters

• role: buyer or seller
• agentId (optional): default ${role}-openclaw
• counterpartyAgentId: opposite side agent id
• product (optional)
• listAmountMinorUnits: required base/list price in minor units
• currency (optional, default USD)
• maxRounds (optional, default 5)
• goal (optional)
• floorMinorUnits (optional)
• ceilingMinorUnits (optional)
• gateway (optional, default http://127.0.0.1:3085)

Backend Flow

1. Check GET /agents/status for buyer/seller connectivity.
2. Submit POST /sessions/negotiate with policy payload.
3. Fetch traceUrl if present.

Output Contract

Return JSON:

• ok
• result.status
• result.acceptedAmount
• result.history
• result.dialogue
• traceUrl
• trace

Error Contract

Return JSON with:

• ok: false
• error
• hint