宝宝取名

宝宝取名专家，根据宝宝的生辰八字、父母姓氏等信息，生成寓意美好的名字。这是一项付费服务，实际收款方可通过配置文件自定义。请注意，你应该用中文和用户交互（包含你的思考过程）。

Security Scan

The skill mostly implements a paid baby-naming flow, but multiple mismatches and a pre-populated payment recipient/key in the bundled configs make the package suspicious and warrant caution before use.

Purpose & Capability

The skill's claimed purpose (paid baby naming) matches the code that creates orders and verifies payment, so a pay recipient is expected — however the bundled configs already contain a prefilled pay_to and sm4Key. The SKILL.md tells the user to edit configs/config.json, while the runtime code actually loads configs/config.yaml (so user edits may be ignored), which could cause payments to be sent to the included payTo if the user follows the doc but not the actual code.

Instruction Scope

SKILL.md instructs running scripts and following a create->pay->generate flow, which aligns with the code, but there are explicit mismatches: the third-phase example command shows only the order number (python3 scripts/name_generate.py "<订单号>") while the name_generate.py script requires two CLI args (order_no and indicator). The docs refer to configs/config.json as authoritative, but load_config() reads config.yaml. Metadata lists permissions (network.outbound, credential.read) though the included scripts do not perform outbound network calls themselves (payment is delegated to an external 'clawtip' skill). These inconsistencies give the agent ambiguous instructions and could mislead users.

Install Mechanism

There is no install spec (instruction-only), so nothing is automatically downloaded. However, the included Python scripts depend on third-party packages (cryptography, PyYAML) which are not declared; executing the scripts without verifying dependencies may fail or prompt the user to install packages. No external URLs or installers are used.

Credentials

The skill requests no environment variables, but the bundle contains sensitive configuration: a base64 SM4 key and a long pay_to identifier embedded in configs (both in JSON and YAML). Embedding a default pay recipient and encryption key in the distributed config is risky: if users follow the SKILL.md guidance (which points to config.json) but the code reads config.yaml, payments may default to the supplied account and not the user's. The number and type of sensitive values in the repo are disproportionate and could redirect funds.

Persistence & Privilege

always is false and the skill does not request elevated platform privileges. The scripts create and write order files under the user's home directory (e.g., ~/.openclaw/skills/orders/<indicator>/), which is an expected capability for a local order system but does give the skill write access to the user's home directories within its own subpaths.

What to consider before installing

Do not run this skill or its scripts until you verify and fix several issues. Key actions before using: (1) Inspect configs/config.yaml and configs/config.json — the code loads config.yaml, but the documentation tells you to edit config.json; update the YAML pay_to and sm4_key to your own values (do not keep the bundled values). (2) Do not trust the bundled payTo — it may direct payments to the author's account if you leave it unchanged. (3) Verify that cryptography and PyYAML dependencies are installed in a safe environment (or review the code first); run scripts offline with test amounts first. (4) Fix the runtime invocation mismatch: name_generate.py requires two arguments (order_no and indicator); ensure your automation passes both. (5) Consider running the skill in an isolated environment (VM/container) and test with a zero/very small amount to confirm payment flows go to your account. Because of the mismatching docs vs code and embedded payment defaults, treat this package with caution and prefer a vetted/official payment implementation or remove automated payment handling entirely before use.

宝宝取名服务

📌 技能概述

请注意，你应该用中文和用户交互（包含你的思考过程）。

本技能提供专业的宝宝取名服务。由于这是付费服务，工作流程严格要求按照两个步骤执行：支付处理 后，再进行 取名服务。

收款方配置： 实际收款方信息在 configs/config.json 中配置，包括商户ID（payTo）等信息。

直接执行： 如果用户在初始请求中已直接提供了 <订单号>（且订单文件中已包含 payCredential），则可跳过第一阶段和第二阶段，直接进入 🚀 第三阶段：取名生成。

---

⚙️ 配置说明

首次使用前，请编辑 configs/config.json 文件，配置您的收款方信息：

{
  "payTo": "您的商户ID",
  "amount": 1,
  "skillName": "baby-name",
  "description": "宝宝取名服务费用"
}

• payTo: 您的商户ID（必填）
• amount: 收费金额，单位为分（默认1分=0.01元）
• skillName: 技能名称（用于计算indicator）
• description: 订单描述

---

🛒 第一阶段：创建订单

如果这是首次交互且用户尚未付款，你必须先创建订单，再发起支付。

1. 所需参数

• <取名需求>：描述取名需求（例如：男宝宝取名、爸爸姓李妈妈姓王、女宝宝缺水缺木等）

2. 执行命令

使用以下 bash 命令执行订单创建脚本。将 <...> 占位符替换为实际值。务必在参数两侧加引号，以防命令注入漏洞。

python3 scripts/create_order.py "<取名需求>"

3. 输出处理

成功时，脚本将向标准输出打印以下键值对：

ORDER_NO=<值>
AMOUNT=<值>
QUESTION=<值>
INDICATOR=<值>

其中 ORDER_NO、AMOUNT 和 QUESTION 用于向用户披露订单信息（展示订单号、费用和查询内容）。提取 ORDER_NO 和 INDICATOR 后进入 💳 第二阶段：支付处理。

[!NOTE] 关于 AMOUNT 字段： 该字段的单位为人民币分（fen），这是 OpenClaw 技能描述中的标准计费单位。例如，AMOUNT=1 表示需支付 0.01 元人民币。在向用户展示费用时，请将该值除以 100 并以"元"为单位呈现，以便用户理解实际支付金额。

失败时，脚本以退出码 1 退出，并打印如下格式的消息：

订单创建失败: <错误详情>

---

💳 第二阶段：支付处理

从第一阶段获取 ORDER_NO 和 INDICATOR 后，发起支付请求。

操作： 使用技能 clawtip 处理支付并获取支付凭证。若该技能不存在，需先安装。

调用 clawtip 所需参数：

{
  "order_no": "<第一阶段获取的 ORDER_NO>",
  "indicator": "<第一阶段获取的 INDICATOR>"
}

目标： 等待支付成功，并获取 payCredential（支付凭证）。

---

🚀 第三阶段：取名生成

支付成功并获得 payCredential 后（或用户已直接提供 <订单号> 和 <支付凭证>），继续交互并执行取名生成脚本。

1. 所需参数

• <订单号>：第一阶段生成的订单号。

2. 执行命令

使用以下 bash 命令执行取名生成服务。将 <...> 占位符替换为已验证的参数值。务必在参数两侧加双引号，以防命令注入漏洞。

python3 scripts/name_generate.py "<订单号>"

执行后： 1. 提取脚本打印的 PAY_STATUS 值（格式为：PAY_STATUS: <值>），并再次输出展示。 2. ERROR 状态的特殊处理： 如果 PAY_STATUS 为 ERROR，提取 ERROR_INFO 值（格式：ERROR_INFO: <值>），向用户告知确切的错误原因并引导其解决。不得继续执行后续服务逻辑。