What does this skill do, and when should you use it?
This Agent Skill guides the writing of payment services in a PinMe Worker (Cloudflare Worker TypeScript) that call UniwebPay directly through the @uniwebpay/sdk. It defines the environment binding contract, SDK client setup, payment methods and currency rules, SDK surface quick reference, webhook integration, security rules, and optional D1 persistence, all backed by a complete reference implementation. It enforces that Worker code must not use PinMe payment proxy routes or legacy VibeCash APIs. It is designed for generating, modifying, or reviewing such payment-related code, ensuring correctness and security.
Reads the Worker's Env bindings to ensure UNIWEB_SECRET and related variables exist; instantiates the UniwebPay SDK client; generates SDK calls for payment links, products/prices, checkout sessions, subscriptions, refunds, and payment status checks; writes webhook handler functions with signature verification, idempotency, amount/currency/order-state validation; enforces security rules to prevent secret leakage; optionally generates D1 table schemas and SQL for order tracking; provides a complete Worker reference implementation for copy-paste or adaptation.
- A developer creates a new PinMe project and needs to quickly add one-time payments via payment links or checkout sessions.
- An existing PinMe project needs to add subscription functionality, using recurring prices and subscription sessions.
- A developer needs to handle UniwebPay webhooks in the Worker to automatically fulfill orders and update statuses.
- A team is refactoring payment code in a Worker and wants to ensure it follows security best practices, avoiding secret leakage and incorrect API usage.
- A project requires multiple payment methods (card, wechat, alipay, paynow) with correct currency rules enforced.
How do you install this skill?
- UniwebPay is an overseas service; access and payments may be restricted from mainland China networks, assess actual reachability.
- SKILL.md claims SDK surface verified but lacks independently reproducible tests or CI coverage; relies on unverified third-party SDK.
- No rollback or recovery steps provided; payment-related operations should be used cautiously in production.
- Recommended to add example inputs/outputs and boundary conditions to support more accurate semantic triggering.
- Shell / CLI
- Network access
- Local filesystem
@uniwebpay/sdkCloudflare WorkersD1 (optional)
This skill is part of the glitternetwork/pinme repository at skills/pinme-uniwebpay/SKILL.md. Install the entire PinMe skill collection with npx skills add glitternetwork/pinme, and the skill will be available in your Claude Code skills directory.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/glitternetwork/pinme.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/pinme-uniwebpay" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Create a payment feature for my PinMe Worker using the UniwebPay SDK, supporting payment links and checkout.
In Claude Code, when you need to generate or modify UniwebPay-related code, prompt like: "Create a payment feature for my PinMe Worker using the UniwebPay SDK, supporting payment links and checkout." The skill will guide you through writing the code, including environment bindings, SDK calls, and webhook handling.
What are this skill's strengths and limitations?
- Provides detailed SDK method and parameter documentation, reducing API lookup time.
- Includes a complete Worker reference implementation ready to use as a template.
- Explicit security rules prevent secret leakage and misuse of the SDK.
- Covers webhook verification, idempotency, and retry logic thoroughly.
- Integrates seamlessly with PinMe's environment bindings.
- Specific to UniwebPay and PinMe; not applicable to other payment gateways or deployment platforms.
- Assumes Cloudflare Workers and TypeScript; not portable to other runtimes.
- No test suite or example configurations provided; requires manual verification.
- Depends on PinMe platform provisioning; missing UNIWEB_SECRET if not enabled or redeployed.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| PinMe UniwebPay Payment Integration this page | 60 · Recommended | ★ 3.7k | 3mo ago | MIT |
| PinMe Worker OpenRouter API Integration | 64 · Recommended | ★ 3.7k | 3mo ago | MIT |
| Workers Production Review | 57 · Use with care | ★ 3k | 3d ago | Apache-2.0 |
| MCP Server Development Guide ✓ Microsoft · Official | 49 · Use with care | ★ 2.7k | 3mo ago | MIT |
| Cloudflare Sandbox Builder | 46 · Use with care | ★ 3k | 3d ago | Apache-2.0 |
How did FollowSkills review this skill?
Evidence shows strong security rules: no secrets in logs/responses/code, webhook route bypasses auth and verifies signature, dangerous operations (webhooks.set/rollSecret etc.) gated to explicit admin requests. However, static review cannot verify dependency security (SDK version, known vulns) and no rollback mechanism or explicit user confirmation steps provided. Deductions for unverified/missing items.
Instructions self-consistent, reference implementation complete, error handling clear (400/500/501). But API surface claims 'verified against source' with no third-party evidence; no tests or examples validate key paths. Static review limitation; deductions for lack of executable verification and edge-case coverage.
Scenarios clear (payment links, checkout, subscriptions), boundaries explicit (no VibeCash etc.). Trigger conditions rely on semantic description without example input/output boundaries. Environment fit: UniwebPay is overseas service, may be unreachable from mainland China; deduction.
Documentation well-layered with environment contract, security rules, reference implementation, SQL examples. But no versioning (for SKILL.md itself), changelog, or maintenance responsibility stated (publisher unverified). Deductions for versioning and maintenance governance gaps.
Core task (payment integration) described clearly, reference implementation provides directly usable code. But output usability unverified; static review cannot confirm actual effectiveness, and overseas service may hinder Chinese users. Deductions for lack of execution verification and applicability evidence.
Some evidence: CI workflow (exists but for CLI, not SKILL itself), tests cover CLI success paths. But SKILL key paths (SDK calls, webhook verification) have no tests or third-party validation. Deductions because evidence is indirect and does not cover skill core.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →