{
  "schemaVersion": "1.0",
  "item": {
    "slug": "leak-buy",
    "name": "Leak Buy",
    "source": "tencent",
    "type": "skill",
    "category": "开发工具",
    "sourceUrl": "https://clawhub.ai/eucalyptus-viminalis/leak-buy",
    "canonicalUrl": "https://clawhub.ai/eucalyptus-viminalis/leak-buy",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/leak-buy",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=leak-buy",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md",
      "scripts/buy.sh"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-30T16:55:25.780Z",
      "expiresAt": "2026-05-07T16:55:25.780Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
        "contentDisposition": "attachment; filename=\"network-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/leak-buy"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/leak-buy",
    "agentPageUrl": "https://openagent3.xyz/skills/leak-buy/agent",
    "manifestUrl": "https://openagent3.xyz/skills/leak-buy/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/leak-buy/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Overview",
        "body": "This skill operates leak buy workflows only:\n\nAccept a promo URL (/) or download URL (/download).\nInclude download-code when required by the seller access mode.\nPay via x402 flow only when required by the seller access mode.\nSave downloaded file locally."
      },
      {
        "title": "Safety policy (required)",
        "body": "Never ask for raw private key text in chat.\nNever create buyer keys from this skill.\nAllow only --buyer-private-key-file <path>.\nBlock raw-key argument mode and stdin key mode.\nNever print private key material.\nNever construct shell commands by concatenating raw user input.\nPass URL/path as quoted argv tokens, never through eval or sh -c.\nReject URL/key path values with whitespace/control characters.\nRequire buyer key path to resolve to an existing readable regular file (non-symlink)."
      },
      {
        "title": "Dependency policy (required)",
        "body": "Require leak binary on PATH.\nDo not execute npx or dynamic package install at runtime."
      },
      {
        "title": "Required inputs",
        "body": "Leak promo or download URL.\nBuyer key file path (required only when payment is required).\nDownload code (required only for download-code modes)."
      },
      {
        "title": "Safe command construction (required)",
        "body": "Use this pattern:\n\nPROMO_URL=\"https://xxxx.trycloudflare.com/\"\nBUYER_KEY_FILE=\"./buyer.key\"\nDOWNLOAD_CODE=\"friends-only\"\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\" --download-code \"$DOWNLOAD_CODE\"\n\nDo not use placeholder interpolation like <...> directly in executable shell strings."
      },
      {
        "title": "Command",
        "body": "bash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\"\n\nWhen download-code is required:\n\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --download-code \"$DOWNLOAD_CODE\" --buyer-private-key-file \"$BUYER_KEY_FILE\""
      },
      {
        "title": "Optional output controls",
        "body": "bash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\" --out ./downloads/myfile.bin\n\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\" --basename myfile"
      },
      {
        "title": "First response template",
        "body": "Confirm URL type (/ or /download).\nAsk for buyer key file path when payment is required.\nAsk for download code when download-code is required.\nValidate URL/key path safety constraints and run with quoted argv tokens.\nReport saved file path and bytes downloaded."
      },
      {
        "title": "Troubleshooting",
        "body": "leak missing:\n\ninstall: npm i -g leak-cli\n\n\nkey mode errors:\n\nuse only --buyer-private-key-file <path>"
      }
    ],
    "body": "leak-buy\nOverview\n\nThis skill operates leak buy workflows only:\n\nAccept a promo URL (/) or download URL (/download).\nInclude download-code when required by the seller access mode.\nPay via x402 flow only when required by the seller access mode.\nSave downloaded file locally.\nSafety policy (required)\nNever ask for raw private key text in chat.\nNever create buyer keys from this skill.\nAllow only --buyer-private-key-file <path>.\nBlock raw-key argument mode and stdin key mode.\nNever print private key material.\nNever construct shell commands by concatenating raw user input.\nPass URL/path as quoted argv tokens, never through eval or sh -c.\nReject URL/key path values with whitespace/control characters.\nRequire buyer key path to resolve to an existing readable regular file (non-symlink).\nDependency policy (required)\nRequire leak binary on PATH.\nDo not execute npx or dynamic package install at runtime.\nRequired inputs\nLeak promo or download URL.\nBuyer key file path (required only when payment is required).\nDownload code (required only for download-code modes).\nSafe command construction (required)\n\nUse this pattern:\n\nPROMO_URL=\"https://xxxx.trycloudflare.com/\"\nBUYER_KEY_FILE=\"./buyer.key\"\nDOWNLOAD_CODE=\"friends-only\"\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\" --download-code \"$DOWNLOAD_CODE\"\n\n\nDo not use placeholder interpolation like <...> directly in executable shell strings.\n\nCommand\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\"\n\n\nWhen download-code is required:\n\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --download-code \"$DOWNLOAD_CODE\" --buyer-private-key-file \"$BUYER_KEY_FILE\"\n\nOptional output controls\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\" --out ./downloads/myfile.bin\n\nbash skills/leak-buy/scripts/buy.sh \"$PROMO_URL\" --buyer-private-key-file \"$BUYER_KEY_FILE\" --basename myfile\n\nFirst response template\nConfirm URL type (/ or /download).\nAsk for buyer key file path when payment is required.\nAsk for download code when download-code is required.\nValidate URL/key path safety constraints and run with quoted argv tokens.\nReport saved file path and bytes downloaded.\nTroubleshooting\nleak missing:\ninstall: npm i -g leak-cli\nkey mode errors:\nuse only --buyer-private-key-file <path>"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/eucalyptus-viminalis/leak-buy",
    "publisherUrl": "https://clawhub.ai/eucalyptus-viminalis/leak-buy",
    "owner": "eucalyptus-viminalis",
    "version": "2026.2.17",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/leak-buy",
    "downloadUrl": "https://openagent3.xyz/downloads/leak-buy",
    "agentUrl": "https://openagent3.xyz/skills/leak-buy/agent",
    "manifestUrl": "https://openagent3.xyz/skills/leak-buy/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/leak-buy/agent.md"
  }
}