Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

fadada-esign

v1.0.0

法大大电子合同与电子签署技能(FASC API 5.0)。一键发送合同给对方签署,支持查询签署状态、下载已签署合同。适用于HR合同、销售合同、协议签署等场景。当用户提到"发合同"、"让对方签合同"、"电子签"、"法大大"、"合同签署"、"查询签署状态"、"下载合同"等场景时触发。

1· 70·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for fadada-esign/fadada-esign-cn.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "fadada-esign" (fadada-esign/fadada-esign-cn) from ClawHub.
Skill page: https://clawhub.ai/fadada-esign/fadada-esign-cn
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install fadada-esign-cn

ClawHub CLI

Package manager switcher

npx clawhub@latest install fadada-esign-cn
Security Scan
Capability signals
Requires walletRequires OAuth token
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name, description, and most files consistently implement an e-signature SDK (upload, create sign task, query, download). However the registry metadata lists no required environment variables or primary credential while SKILL.md and code clearly expect FADADA_APP_ID / FADADA_APP_SECRET / FADADA_OPEN_CORP_ID — a manifest/documentation mismatch that is incoherent and worth flagging.
!
Instruction Scope
Runtime instructions and code perform expected actions (read config from ~/.fadada or local .fadada.json, read files to upload, call external API endpoints). But there are conflicting/inconsistent instructions across files: one SKILL.md and some reference docs describe an MD5-based signature (AppId+Timestamp+MsgId+AppSecret) while client.py implements a two-step HMAC-SHA256 scheme; various example scripts expect different response codes/JSON formats. Those inconsistencies could lead to misconfiguration or misuse and indicate the package is a mix of multiple versions.
Install Mechanism
No install spec in the skill metadata (instruction-only from the platform perspective). The package includes a standard setup.py and pure-Python code that depends on requests; no remote downloads, obfuscated binaries, or unusual install URLs were observed.
!
Credentials
The secrets the code requests (app_id, app_secret, open_corp_id) are appropriate for an e-sign SDK. However the registry metadata did not declare these required env vars, and multiple files/examples show different places to store secrets (env, config file, or code). The code reads configuration files in the current directory and the user's home directory (~/.fadada), which is expected but means existing local configs could be picked up unexpectedly. Overall credential use is proportionate to the claimed purpose but the metadata omission and inconsistent handling are concerning.
Persistence & Privilege
Skill is not always-included and is user-invocable. It does write a per-user config file (~/.fadada/config.json) via its interactive setup, but the save() implementation intentionally omits app_secret when writing; the skill does not request system-wide privileges or modify other skills. Autonomous invocation is allowed but that is the platform default.
What to consider before installing
This package looks like a FaDaDa (法大大) e-sign SDK and reasonably needs FaDaDa credentials, but there are inconsistencies that warrant caution. Before installing or giving it any secrets: 1) Verify provenance — find the upstream/source repository (setup.py points at a GitHub URL) and compare files to an official FaDaDa SDK; 2) Prefer testing in a sandbox account and use sandbox mode if available; 3) Do not store your production app_secret in shared or world-readable config files — prefer environment variables and check that config files created by the tool do not contain the secret; 4) Inspect the code yourself (or have a developer do so) to confirm which signing algorithm and endpoints are used (client.py implements HMAC-SHA256 while some docs show MD5 — confirm which your FaDaDa account expects); 5) Run the CLI in an isolated environment/container and with only test credentials to ensure behavior matches expectations; 6) If you cannot confirm the source or resolve the doc/code conflicts, avoid using production credentials with this package. If you want, provide the upstream repository link (or the publisher identity) and I can re-check differences and point to exact files that mismatch.

Like a lobster shell, security has layers — review code before you run it.

latestvk9781n7z6mtwazfy84qxwm7r0184t65p
70downloads
1stars
1versions
Updated 2w ago
v1.0.0
MIT-0

法大大电子签 Skill(FASC API 5.0)

基于法大大 FASC API 5.0,提供一键式合同创建、发送、签署全流程解决方案。

✨ 核心特性

  • 一键发送 - 只需一行代码即可完成文件上传、任务创建、获取签署链接
  • 正确签名 - 严格按照官方文档实现 HMAC-SHA256 两步签名算法
  • 智能配置 - 支持环境变量、配置文件、代码传入多种配置方式
  • 命令行工具 - 提供 fadada CLI 工具,无需编写代码即可发送合同
  • 完整功能 - 支持发送、查询、下载全流程

🚀 快速开始

1. 安装

# 安装依赖
pip install requests

2. 配置凭证

方式一:环境变量

export FADADA_APP_ID="your_app_id"
export FADADA_APP_SECRET="your_app_secret"
export FADADA_OPEN_CORP_ID="your_open_corp_id"

方式二:配置文件

# 创建配置文件
mkdir -p ~/.fadada
cat > ~/.fadada/config.json << EOF
{
  "app_id": "your_app_id",
  "app_secret": "your_app_secret",
  "open_corp_id": "your_open_corp_id"
}
EOF

方式三:代码中直接传入

from fadada_esign import FaDaDaClient, Signer

client = FaDaDaClient(
    app_id="your_app_id",
    app_secret="your_app_secret",
    open_corp_id="your_open_corp_id"
)

3. 发送合同(最简单的方式)

from fadada_esign import FaDaDaClient, Signer

# 创建客户端
client = FaDaDaClient(
    app_id="your_app_id",
    app_secret="your_app_secret",
    open_corp_id="your_open_corp_id"
)

# 一键发送合同
result = client.send_to_single_signer(
    file_path="/path/to/contract.pdf",
    signer_name="张三",
    signer_mobile="13800138000",
    task_subject="劳动合同签署"
)

print(f"签署链接: {result['sign_url']}")

4. 命令行发送

# 发送给单个签署人
fadada send contract.pdf --signer "张三:13800138000"

# 发送给多个签署人
fadada send contract.pdf --signer "张三:13800138000" --signer "李四:13900139000"

# 指定任务主题
fadada send contract.pdf --signer "张三:13800138000" --subject "销售合同"

📖 API 文档

客户端初始化

from fadada_esign import FaDaDaClient

# 正式环境
client = FaDaDaClient(
    app_id="your_app_id",
    app_secret="your_app_secret",
    open_corp_id="your_open_corp_id"
)

# 沙箱环境
client = FaDaDaClient(
    app_id="your_app_id",
    app_secret="your_app_secret",
    open_corp_id="your_open_corp_id",
    sandbox=True
)

一键发送文档

from fadada_esign import FaDaDaClient, Signer

client = FaDaDaClient(...)

# 方式1:发送给单个签署人(最简单)
result = client.send_to_single_signer(
    file_path="/path/to/contract.pdf",
    signer_name="张三",
    signer_mobile="13800138000"
)

# 方式2:发送给多个签署人
signers = [
    Signer(name="张三", mobile="13800138000", actor_id="signer1"),
    Signer(name="李四", mobile="13900139000", actor_id="signer2")
]

result = client.send_document(
    file_path="/path/to/contract.pdf",
    signers=signers,
    task_subject="多方合同"
)

# 返回结果
print(result)
# {
#     "sign_task_id": "1774590564587181726",
#     "sign_url": "https://fdd1.cn/dQFiT0SDcw1",
#     "task_subject": "多方合同",
#     "file_path": "/path/to/contract.pdf",
#     "signers": [...]
# }

分步操作

from fadada_esign import FaDaDaClient, Signer

client = FaDaDaClient(...)

# 1. 上传文件
file_id = client.upload_file("/path/to/contract.pdf")

# 2. 创建签署任务
signer = Signer(name="张三", mobile="13800138000")
sign_task_id = client.create_sign_task(
    task_subject="合同签署",
    file_id=file_id,
    signers=[signer]
)

# 3. 获取签署链接
sign_url = client.get_sign_url(sign_task_id)

查询签署状态

# 查询任务详情
detail = client.query_task_detail(sign_task_id)
print(detail)
# {
#     "signTaskId": "xxx",
#     "signTaskSubject": "合同签署",
#     "signTaskStatus": "sign_progress",
#     "actors": [...]
# }

下载已签署文档

# 获取下载链接
download_url = client.get_download_url(sign_task_id)
print(f"下载链接: {download_url}")

# 或者直接下载
import requests
response = requests.get(download_url)
with open("signed_contract.pdf", "wb") as f:
    f.write(response.content)

🔧 命令行工具

配置管理

# 交互式配置
fadada config setup

# 查看当前配置
fadada config show

发送合同

# 基础用法
fadada send contract.pdf --signer "张三:13800138000"

# 多个签署人
fadada send contract.pdf \
    --signer "张三:13800138000" \
    --signer "李四:13900139000" \
    --subject "合作协议"

# 保存结果到文件
fadada send contract.pdf \
    --signer "张三:13800138000" \
    --output result.json

查询状态

fadada status <task_id>

下载合同

fadada download <task_id> --output ./signed_contract.pdf

📋 签署任务状态

状态说明
draft创建中
submitting提交中
fill_wait等待填写
filled填写完成
sign_progress签署进行中
finished已完成
cancelled已撤销
expired已过期

📝 签署人配置

from fadada_esign import Signer

# 基础配置
signer = Signer(
    name="张三",
    mobile="13800138000"
)

# 完整配置
signer = Signer(
    name="张三",
    mobile="13800138000",
    actor_id="signer1",
    actor_type="person",  # person 或 corp
    permissions=["sign"],
    notification={
        "sendNotification": True,
        "notifyWay": "mobile",
        "notifyAddress": "13800138000"
    },
    id_number="11010119900101xxxx",  # 可选
    email="zhangsan@example.com"  # 可选
)

⚙️ 配置优先级

配置加载优先级(从高到低):

  1. 代码中显式传入的参数
  2. 环境变量(FADADA_APP_ID, FADADA_APP_SECRET, FADADA_OPEN_CORP_ID
  3. 本地配置文件(.fadada.jsonfadada_config.json
  4. 全局配置文件(~/.fadada/config.json

🔐 安全注意事项

  • App Secret 不要硬编码在代码中,建议使用环境变量或配置文件
  • 配置文件权限建议设置为 600(仅所有者可读写)
  • 生产环境建议使用正式环境(sandbox=False)

🐛 错误处理

from fadada_esign import FaDaDaClient, Signer
from fadada_esign.exceptions import FaDaDaError, FaDaDaAuthError, FaDaDaAPIError

client = FaDaDaClient(...)

try:
    result = client.send_to_single_signer(...)
except FaDaDaAuthError as e:
    print(f"认证失败: {e}")
except FaDaDaAPIError as e:
    print(f"API 错误: {e.code} - {e}")
except FaDaDaError as e:
    print(f"操作失败: {e}")

📚 完整示例

#!/usr/bin/env python3
"""
法大大电子签 - 完整示例
"""

from fadada_esign import FaDaDaClient, Signer

def main():
    # 初始化客户端
    client = FaDaDaClient(
        app_id="your_app_id",
        app_secret="your_app_secret",
        open_corp_id="your_open_corp_id",
        sandbox=False  # 生产环境
    )
    
    # 创建签署人
    signers = [
        Signer(name="张三", mobile="13800138000", actor_id="signer1"),
        Signer(name="李四", mobile="13900139000", actor_id="signer2")
    ]
    
    # 发送合同
    result = client.send_document(
        file_path="./劳动合同.pdf",
        signers=signers,
        task_subject="2024年劳动合同"
    )
    
    print("=" * 50)
    print("✅ 合同发送成功!")
    print("=" * 50)
    print(f"任务 ID: {result['sign_task_id']}")
    print(f"签署链接: {result['sign_url']}")
    print()
    
    # 保存任务ID供后续查询
    task_id = result['sign_task_id']
    
    # 稍后查询状态
    # detail = client.query_task_detail(task_id)
    # print(f"当前状态: {detail['signTaskStatus']}")
    
    # 签署完成后下载
    # download_url = client.get_download_url(task_id)
    # print(f"下载链接: {download_url}")

if __name__ == "__main__":
    main()

📄 文件结构

fadada_esign/
├── __init__.py      # 包入口
├── client.py        # 核心客户端
├── signer.py        # 签署人模型
├── config.py        # 配置管理
├── cli.py           # 命令行工具
└── exceptions.py    # 异常类

🔗 相关链接

📄 License

MIT License

Comments

Loading comments...