技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 1.5k · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：ahsanatha/mayar-payment-skill
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill appears to implement a legitimate Mayar payment integration, but there are inconsistencies and runtime behaviors (undocumented credential handling and dynamic package execution via npx) that warrant caution before installing.
目的
The SKILL.md and README clearly describe a Mayar.id payment integration (invoice creation, transaction queries, webhooks) and the included references align with that purpose. HOWEVER the registry metadata did not declare any required credentials or binaries even though the documentation requires an API key, mcporter, and Node/npx — this metadata omission is an inconsistency.
说明范围
Instructions stay within the payment-integration scope (create credentials file, add mcporter server, call mcporter tools, register webhooks). They do instruct writing credentials to ~/.config/mayar/credentials and embedding the API token into config/mcporter.json Authorization header (which is functionally necessary but can leak if configs are not handled securely). No instructions ask the agent to read unrelated system files or exfiltrate da…
安装机制
There is no formal install spec (instruction-only), but the mcporter configuration calls npx mcp-remote at runtime. That implies dynamic download-and-execute of the 'mcp-remote' npm package when mcporter starts. The skill/package does not declare or vet that package in the metadata; dynamic npx execution is a higher-risk behavior and should be reviewed (verify the npm package source and integrity) before enabling.
证书
The skill requires a sensitive Mayar API JWT token (documented in SKILL.md) but the registry metadata declares no required env vars or primary credential — a mismatch. The instructions ask you to store the token in a local credentials file and to place it in the mcporter.json Authorization header; this is proportional to the payment use-case but is sensitive and should be protected (platform-managed secret store preferred).
持久
The skill does not request always:true, does not modify other skills, and has no install that writes persistent system-wide components. Its persistence is limited to the user-supplied credential file and mcporter configuration, which is expected for this integration.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Mayar.id Payment」。简介：Integrate Mayar.id for Indonesian payments to create invoices, generate payment…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/ahsanatha/mayar-payment-skill/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。