Skill: xhc1111/my-pay (version 1.0.1)

--- name: mypay description: > A payment skill powered by mypay-bot CLI. Use this skill whenever the user wants to pay, make a payment, purchase something, buy items, checkout, transfer money, or do anything related to spending or transactions. Trigger on keywords like: pay, payment, buy, purchase, checkout, order, shop, wallet, transaction, transfer, even if the user doesn't explicitly say "pay" — if the intent involves spending money, use this skill. compatibility: requires_tools: - Bash requires_binaries: - python3 - npm - node requires_credentials: - name: MYPAY_API_KEY description: "mypay-bot API key for authenticating payment requests. Obtain from your MyPay dashboard." required: true - name: MYPAY_WALLET_SECRET description: "Wallet secret for signing transactions. Generated during mypay-bot initial setup." required: true --- # MyPay - Payment Skill This skill handles payment workflows using the `mypay-bot` CLI tool. ## System Requirements - **python3**: Required to run the dependency checker script - **node / npm**: Required to install and run the `mypay-bot` CLI globally - **mypay-bot**: The CLI binary itself — must be installed manually by the user (see Prerequisites below) ## Authentication mypay-bot requires two credentials to operate. These must be configured before the first payment: - **MYPAY_API_KEY** — API key from your MyPay dashboard, used for authenticating all requests. - **MYPAY_WALLET_SECRET** — Wallet signing secret, generated during `mypay-bot init` setup. If credentials are missing or invalid, `mypay-bot` commands will fail with an auth error. When that happens, instruct the user to run `mypay-bot init` to configure credentials interactively, or to set the environment variables `MYPAY_API_KEY` and `MYPAY_WALLET_SECRET`. ## Prerequisites Check (MUST run first) Before doing anything else, run the dependency checker script: ```bash python3 "{{SKILL_DIR}}/scripts/install_mypay.py" ``` This script **only checks** — it does not install or modify anything on the system. It verifies: 1. Whether `mypay-bot` is installed globally 2. Whether the installed version matches the pinned version (`1.0.0`) **Exit codes:** - `0` — Ready to proceed. - `1` — `mypay-bot` is not installed. **Stop the workflow**, show the user the install command printed by the script, and ask them to run it manually. Do NOT run `npm install` yourself. - `2` — Installed but version mismatch. Inform the user an update is available and show the command. The workflow may proceed with the current version at the user's discretion. The script never runs `npm install` or modifies global packages. Installation and updates are the user's responsibility — this avoids executing unverified code automatically. ## Payment Workflow Follow these steps in order. Do NOT skip any step. ### Step 0: Capture Payment Intent First, summarize the payment/purchase intent from the current conversation: ```bash mypay-bot payment-intent ``` Review the output carefully. Then cache the summary: ```bash mypay-bot payment-intent --summary ``` ### Step 1: Check Wallet Status Verify the user's wallet is ready: ```bash mypay-bot check-wallet ``` Review the wallet status output. If there are any issues (insufficient funds, locked wallet, etc.), inform the user before proceeding. ### Step 2: Submit Payment Execute the payment using the payment link from the previous steps: ```bash mypay-bot submit-payment --payment-link "<payment_link>" ``` Replace `<payment_link>` with the actual payment link obtained from the workflow. ## Critical Rules - **Preserve all links and images exactly**: Every URL, link, and image reference that appears in the output of any mypay-bot command MUST be copied in full — character for character, with no truncation, no summarization, no reformatting. This includes query parameters, tokens, hashes, and any other URL components. Display them to the user exactly as received. - **Follow the step order strictly**: Step 0 -> Step 1 -> Step 2. Do not skip or reorder. - **Always run the prerequisite checker first**: Before each skill invocation, run the Python checker to verify mypay-bot is present. Never run `npm install` automatically — if the check fails, inform the user and let them install manually.

path: scripts/install_mypay.py
content: #!/usr/bin/env python3
"""
install_mypay.py - Dependency checker for mypay-bot npm package.

This script ONLY checks whether mypay-bot is installed and whether an update
is available. It does NOT install or update anything automatically.
It exits with:
  0 — mypay-bot is installed and up to date (or version check was skipped)
  1 — mypay-bot is not installed (user action required)
  2 — mypay-bot is installed but outdated (informational, non-blocking)
"""

import subprocess
import sys
import json
import shutil

# Pin to a known-good version to prevent silent upgrades to untested releases.
REQUIRED_VERSION = "1.0.0"


def run_cmd(cmd):
    """Run a shell command and return (returncode, stdout)."""
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True, text=True, timeout=30
        )
        return result.returncode, result.stdout.strip()
    except (subprocess.TimeoutExpired, Exception) as e:
        print(f"[mypay] Command failed: {cmd} -> {e}")
        return 1, ""


def check_npm_available():
    """Verify npm is on PATH."""
    if not shutil.which("npm"):
        print("[mypay] ERROR: npm is not found on PATH.")
        print("[mypay] Please install Node.js and npm first: https://nodejs.org/")
        return False
    return True


def get_installed_version():
    """Get the currently installed global version of mypay-bot, or None."""
    code, output = run_cmd("npm list -g mypay-bot --json 2>/dev/null")
    if code != 0 or not output:
        return None
    try:
        data = json.loads(output)
        deps = data.get("dependencies", {})
        if "mypay-bot" in deps:
            return deps["mypay-bot"].get("version")
    except (json.JSONDecodeError, KeyError):
        pass
    return None


def main():
    if not check_npm_available():
        sys.exit(1)

    installed = get_installed_version()

    if installed is None:
        print("[mypay] MISSING: mypay-bot is not installed.")
        print(f"[mypay] To install the required version, run manually:")
        print(f"[mypay]   npm install -g mypay-bot@{REQUIRED_VERSION}")
        print("[mypay] After installing, re-run this skill.")
        sys.exit(1)

    if installed != REQUIRED_VERSION:
        print(f"[mypay] WARNING: installed version is {installed}, expected {REQUIRED_VERSION}.")
        print(f"[mypay] To update, run manually:")
        print(f"[mypay]   npm install -g mypay-bot@{REQUIRED_VERSION}")
        print("[mypay] Proceeding with the installed version for now.")
        sys.exit(2)

    print(f"[mypay] OK: mypay-bot {installed} is installed and matches the required version.")
    sys.exit(0)


if __name__ == "__main__":
    main()


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)