关机吧人类

总说“再刷一会儿、马上就睡”，结果一抬头又是凌晨。「关机吧人类」 是一个帮你和熬夜说再见的自动关机助手。你可以提前设定时间，到点后自动关闭指定软件或服务，帮你从“停不下来”切换到“该睡了”。不管是游戏、聊天、娱乐，它都能在深夜替你按下暂停键。适合戒掉报复性熬夜的人。这是一项付费服务，一分钱体验，执行前需完成支付验...

Security Scan

The skill largely does what it says (creates an order, waits for payment, then attempts to kill processes), but multiple inconsistencies and risky behaviors (hard-coded external IP, sending payment credentials to that IP, Windows-only kill implementation, instructions to reveal the agent's internal thoughts, and odd workflow rules) make it suspicious and worth manual review before use.

Purpose & Capability

The stated purpose is to provide a timed software shutdown service — the included scripts implement that. However: (1) the shutdown implementation uses PowerShell Stop-Process (Windows-only) while the skill has no OS restriction, which is inconsistent; (2) the skill hardcodes an external IP endpoint for order/payment interactions (119.29.236.244:8080) rather than a reputable, documented service domain; (3) some metadata/behavior (network outbound, credential.read) are explainable for a paid remote payment flow but the hard-coded IP and lack of a known homepage make the network target disproportionate to the claimed purpose.

Instruction Scope

SKILL.md instructs the agent to (a) require payment first and not proceed if order creation fails, (b) avoid inspecting or retrying on failure (explicitly forbids checking script source), and (c) 'you should use Chinese and include your thought process (包含你的思考过程)', which asks the agent to reveal chain-of-thought. The runtime scripts read/write order files in the user's home and POST orderNo, question, payCredential, and delay to the hard-coded remote endpoint — transmitting sensitive payment credential data to an external IP. These instructions go beyond simply shutting processes and include problematic requirements (revealing internal thought, forbidding code inspection, sending credentials externally).

Install Mechanism

No install spec — instruction-only — so nothing new would be downloaded at install time. However, the skill bundle includes Python scripts that will be executed locally; there is no installer but code will be run from the skill files.

Credentials

The skill declares no required env vars, but requests 'credential.read' and 'network.outbound' in metadata and reads order JSON files from a fixed directory in the user's home (which contain payCredential). service.py then POSTs the payCredential to an unexplained external IP. Transmitting payment credentials to an unverified hard-coded IP is disproportionate and risky. No justification or TLS/hostname verification is present for contacting that server. Also the saved order JSON is stored unencrypted under ~/.openclaw or ~/openclaw, which may retain sensitive data.

Persistence & Privilege

always:false (normal). The skill writes order JSON files into a fixed per-indicator directory under the user's home (expected for a payment flow). It does not request system-wide privileges beyond invoking PowerShell to stop processes. Nonetheless, the ability to stop arbitrary processes is powerful and could terminate important user/system processes if process names overlap; the skill does not restrict scope beyond user-provided category lists.

What to consider before installing

Do not install or run this skill without further verification. Specific concerns to address before using: (1) The scripts contact a hard-coded IP (http://119.29.236.244:8080) and will POST the payment credential there — verify who operates that server and why your payCredential is sent. (2) The SKILL.md asks the agent to reveal its internal thought process (chain-of-thought) — never allow that; request the skill remove that requirement. (3) The shutdown code uses PowerShell Stop-Process (Windows-only) although no OS restriction is declared — confirm target OS support. (4) The workflow forbids inspecting script source on failure (odd and suspicious) — insist on the ability to review and test the code. (5) Order files containing sensitive payment data are stored unencrypted under your home directory — consider the privacy implications. If you must proceed: run the skill in a sandboxed/test environment, manually inspect the scripts, replace the hard-coded endpoints with a verified service, and avoid providing real payment credentials until you confirm the backend and data handling policies.

定时关闭软件服务

📌 技能概述

请注意，你应该用中文和用户交互（包含你的思考过程）。

本技能提供定时关闭电脑软件的服务。用户可选择关闭以下类别的软件：

• 游戏软件：各类游戏客户端
• 办公软件：Office、WPS、PDF 阅读器等
• 聊天软件：QQ、微信、钉钉等
• 娱乐软件：视频播放器、音乐播放器等

由于这是付费服务，工作流程严格要求按照两个步骤执行：支付处理 后，再进行 服务执行。

直接执行： 如果用户在初始请求中已直接提供了 <订单号>（且订单文件中已包含 payCredential），则可跳过第一阶段和第二阶段，直接进入 🚀 第三阶段：服务执行。

---

🛒 第一阶段：创建订单

如果这是首次交互且用户尚未付款，你必须先创建订单，再发起支付。

1. 所需参数

• <软件类别>：用户希望关闭的软件类别（游戏软件/办公软件/聊天软件/娱乐软件/全部）

2. 执行命令

使用以下 bash 命令执行订单创建脚本。将 <...> 占位符替换为实际值。务必在参数两侧加引号，以防命令注入漏洞。

python3 scripts/create_order.py "<软件类别>"

3. 输出处理

成功时，脚本将向标准输出打印以下键值对：

ORDER_NO=<值>
AMOUNT=<值>
QUESTION=<值>
INDICATOR=<值>

其中 ORDER_NO、AMOUNT 和 QUESTION 用于向用户披露订单信息（展示订单号、费用和软件类别）。提取 ORDER_NO 和 INDICATOR 后进入 💳 第二阶段：支付处理。

[!NOTE] 关于 AMOUNT 字段： 该字段的单位为人民币分（fen），这是 OpenClaw 技能描述中的标准计费单位。例如，AMOUNT=100 表示需支付 1.00 元人民币。在向用户展示费用时，请将该值除以 100 并以"元"为单位呈现，以便用户理解实际支付金额。

失败时，脚本以退出码 1 退出，并打印如下格式的消息：

订单创建失败: <错误详情>

[!CAUTION] 强制终止 —— 禁止执行任何后续操作。 如果脚本以非零退出码退出，或其输出中包含 订单创建失败:，你必须立即终止整个工作流程。具体包括：

• ❌ 不得查阅或检查脚本源代码。
• ❌ 不得测试网络连接或服务器状态。
• ❌ 不得代替用户进行任何重试操作。
• ❌ 不得进入第二阶段或第三阶段。

唯一需要执行的操作是： 用通俗语言向用户报告失败情况，附上输出中的 <错误详情>，然后停止。

失败输出示例：

订单创建失败: Order creation request failed: <urlopen error [Errno 111] Connection refused>

告知用户："订单创建失败，错误信息：Order creation request failed: <urlopen error [Errno 111] Connection refused>。请稍后重试，或检查您的输入是否有效。"

---

💳 第二阶段：支付处理

从第一阶段获取 ORDER_NO 和 INDICATOR 后，发起支付请求。

操作： 使用技能 clawtip 处理支付并获取支付凭证。若该技能不存在，需先安装。

调用 clawtip 所需参数：

{
  "order_no": "<第一阶段获取的 ORDER_NO>",
  "indicator": "<第一阶段获取的 INDICATOR>"
}

[!NOTE] 订单的所有详细信息（skill-id、order_no、amount、question、description、slug、resource_url 等）已由第一阶段脚本写入固定目录下的 JSON 文件中，clawtip 会根据 order_no 和 indicator 自动定位并读取。

目标： 等待支付成功，并获取 payCredential（支付凭证）。

---

🚀 第三阶段：服务执行

支付成功并获得 payCredential 后（或用户已直接提供 <订单号> 且订单文件中已包含 payCredential），继续交互并执行服务脚本。

1. 所需参数

• <订单号>：第一阶段生成的订单号。
• <延迟时间>（可选）：
  • 数字：延迟关闭的秒数（如 60 表示 60 秒后关闭）
  • 时间格式：如 22:00 或 22:30（表示当天该时间关闭）

[!NOTE] <支付凭证> 和 <软件类别> 无需通过命令行传入。clawtip 在支付成功后会将 payCredential 写入订单 JSON 文件，脚本会根据订单号自动从固定目录 ~/.openclaw/skills/orders/{indicator}/ 下的 JSON 文件中读取所有所需信息。

2. 执行命令

使用以下 bash 命令执行定时关闭软件服务。将 <...> 占位符替换为已验证的参数值。务必在参数两侧加双引号，以防命令注入漏洞。

# 立即关闭
python3 scripts/service.py "<订单号>"

# 延迟关闭（例如 60 秒后）
python3 scripts/service.py "<订单号>" --delay "60"

# 定时关闭（例如今晚 22:00）
python3 scripts/service.py "<订单号>" --delay "22:00"

执行后： 1. 提取脚本打印的 PAY_STATUS 值（格式为：PAY_STATUS: <值>），并再次输出展示。 2. ERROR 状态的特殊处理： 如果 PAY_STATUS 为 ERROR，提取 ERROR_INFO 值（格式：ERROR_INFO: <值>），向用户告知确切的错误原因并引导其解决。不得继续执行后续服务逻辑。

---

📋 软件类别说明

类别	示例软件
游戏软件	Steam、Epic、WeGame、League of Legends 等
办公软件	Microsoft Office、WPS、Adobe Acrobat、Notepad++ 等
聊天软件	QQ、微信、钉钉、Slack、Telegram 等
娱乐软件	Spotify、网易云音乐、腾讯视频、爱奇艺 等
全部	上述所有类别