自动 Google 评论回复商家入驻

安装指南

1. ClawHub CLI 从源直接安装技能的最快方式。
   npx clawhub@latest install google-autoreply
2. 手动安装 将技能文件夹复制到以下位置之一
   全局模式
   ~/.openclaw/skills/
   工作区
   /skills/
   优先级：工作区 > 本地 > 内置
3. 提示词安装 将此提示词复制到 OpenClaw 即可自动安装。
   请帮我使用 Clawhub 安装 google-autoreply。如果尚未安装 Clawhub，请先安装（npm i -g clawhub）。
   更倾向于下载？
   获取包含原生技能文件的ZIP压缩包。
   下载技能 (.zip)

什么是

此 Openclaw Skills 集成引导 AI 代理完成自动 Google 评论回复的完整入驻流程：注册或登录账户、授权 Google Business Profile、选择地点、验证会员资格以及配置 AI 自动回复。它与生产环境 REST 后端通信，并在继续前确认每个阶段。
该技能为新建商店提供五天免费试用，避免不必要的付款请求，并通过 AUTH_TOKEN 环境变量安全管理会话授权。商家可以配置星级阈值、语言、签名、商店介绍、关键词和 AI 指令。产品登录账户与 Google Business 账户可以不同。

应用场景

将新商家引导至自动 Google 评论回复产品。
通过 Google OAuth 或用户名和密码注册或登录现有产品用户。
连接由其他 Google 账户管理的 Google Business Profile。
当账户拥有多家商店时，选择并绑定正确的 Google Business 地点。
检查商店是否享有自动五天免费试用或有效付费会员资格。
仅在试用或会员资格结束后，将过期商家引导至 Stripe 结账。
创建或更新商店的 AI 评论自动回复规则。
配置最低星级、回复语言、签名、商店介绍、关键词和回复长度。
根据 Business Profile 生成 AI 客户配置。
为示例 Google 评论预览 AI 回复。
通过断开并重新连接 Google Business Profile，修复错误连接。

工作原理

收集商家的账户状态、Google Business 管理账户、目标商店、回复语言、星级阈值、商店介绍、签名和关键词。
使用 Google OAuth、用户名和密码或安全 SSO 交接流程验证商家。浏览器自动化不可用时，创建短期交接槽并轮询，直到授权就绪。
将返回的授权值保存为 AUTH_TOKEN，并使用 GET /admin/info 验证。所有 API 调用复用同一令牌，仅在收到 401 后重新授权。
使用 GET /google-business/status 检查 Google Business 连接状态，必要时使用管理目标资料的账户打开 Google Business OAuth 流程。
使用 GET /google-my-business/locations/current 获取当前绑定商家和可选地点，确认目标地点后使用 POST /google-my-business/locations/bind 绑定。
使用 GET /shop/getCurShop 检查商店会员资格。未来的 vip_expire_time 表示 ACTIVE，包括自动五天试用；缺失或已过期表示 EXPIRED。
会员过期时确认月度或年度方案，创建 Stripe 结账会话并在付款后验证会员资格。试用有效时绝不请求付款。
使用 GET /news/getAutoReviewsList 加载现有自动回复设置，必要时从 Business Profile 生成配置，或直接收集商家规则。
创建或更新每个商店的自动回复配置，并通过商店关键词端点添加或删除关键词。
确认已保存配置启用，并可为示例评论生成预览回复。

配置指南

设置后端 URL，并通过指定环境变量提供会话授权。绝不要硬编码令牌、将其放入 URL、作为查询参数发送或完整打印。
export API_BASE_URL="https://apprest.mytruststores.com/adminServer"
export AUTH_TOKEN="Bearer "
入驻前验证会话：
curl --fail "$API_BASE_URL/admin/info"
-H "Authorization: $AUTH_TOKEN" 对于没有浏览器自动化的代理，创建 SSO 交接槽，将返回的登录 URL 发送给商家，并每两到三秒轮询一次：
curl -X POST "$API_BASE_URL/oauth2/handoff/create"
--data-urlencode "returnUrl=" curl "$API_BASE_URL/oauth2/handoff//token"
后端从 Spring Security 配置读取 Google Business OAuth 客户端凭据。代理不需要 Google client ID 或 client secret 环境变量。Google Business 访问令牌和刷新令牌由后端持久化并刷新。任何 code 不为 200 的响应都应视为错误，并向商家显示其消息。

数据架构

核心认证和账户数据
Data Location or endpoint Handling
产品会话令牌 AUTH_TOKEN environment variable 保存完整 Authorization header 值，并用于每次 API 请求。
SSO 交接 /oauth2/handoff/create and /oauth2/handoff/{handoffId}/token 一次性槽，有效约三分钟；获取后删除授权。
Google Business OAuth tokens Backend googleBusinessToken database field 由后端拥有、持久化并自动刷新；代理不得存储。
用户和商店身份 /admin/info and /shop/getCurShop 用于确认认证、所选商店和会员状态。
商店和会员分类
vip_expire_time 在未来：ACTIVE，包括自动五天试用。
vip_expire_time 为 null 或在过去：EXPIRED。
创建第一家商店并开始试用时分配 vipLevel = basic。
后端会员错误可能返回 403001 或 403002。
Stripe 产品为月度方案 Review_Basic_Monthly，年度方案 Review_Basic。
Google Business 地点数据
/google-business/status 包含 connected、tokenValid、createdAt 和 expiresIn 等连接元数据，不标识商店。
/google-my-business/locations/current 返回 list、current 和 selectable。
current 标识当前绑定商家；list 包含可选地点。
绑定前删除开头的 locations/ 前缀以规范化地点标识符。
list 为空且 current 为 null，表示授权 Google 账户没有可用 Business Profile 地点。
自动回复配置
Field Purpose
startCount 触发自动回复的最低评论星级，范围为 1 到 5。
status 1 启用自动回复；0 禁用。
replyLanguage auto、zh、en、fr、es 或 it。
sign 可选商家签名。
translaSign 控制签名翻译行为。
shopIntroduction 用于生成回复的可选商家背景。
advancedTips 额外 AI 指令。
maxLength 最大回复长度。
keywords 回复生成所用的商店专属词语。
aiReplyType AI 回复模式；标准配置使用 1。
已有配置使用其 id 更新，否则创建新记录。商店关键词独立通过 /news/{shopId}/keywords 管理。

高级特性

支持浏览器感知认证和安全 SSO 交接模式，避免要求商家复制粘贴敏感令牌。
Google OAuth 账户独立性：产品登录身份无需与 Google Business Profile 管理员身份一致。
后端使用持久化刷新令牌自动刷新短期 Google Business 访问令牌。
认证、地点绑定、会员验证和配置均设有顺序工作流门控及明确成功检查。
自动识别五天试用，避免向符合条件的新商店强制收费。
为过期会员提供支持月度和年度方案的 Stripe 订阅升级。
根据 Business Profile 数据生成 AI 客户配置，并在生成前验证配额。
支持现有商店自动回复配置的创建或更新。
管理每个商店的关键词生命周期，包括列出、添加和删除。
使用评论文本、星级、关键词、签名、商店背景和回复限制生成 AI 评论预览。
安全处理非 200 响应、过期会话、无效会员、缺失地点和错误绑定的资料。
令牌卫生控制确保机密信息不进入提示词、日志、源代码和 URL，适合安全的 Openclaw Skills 自动化。

name: "google-autoreply" description: "Onboard a merchant into the Auto Google Review Reply product: register/login, connect a Google Business Profile, benefit from a 5-day free trial (membership check, no forced payment), and configure AI auto-reply. Invoke when the user wants to set up an account, connect Google Business, check membership/ trial status, or enable AI review auto-reply."

Auto Google Review Reply - Merchant Onboarding

This skill drives an AI agent to onboard a merchant end-to-end into the Auto Google Review Reply product. It guides the AI to (1) get the merchant signed in, (2) connect a Google Business Profile, (3) confirm membership / free-trial status (new shops get a 5-day free trial and are not forced to pay), and (4) configure the AI review auto-reply. The AI talks to the merchant and calls the real backend REST APIs.

Product Context

Login account and Google Business account do NOT need to be the same. The merchant signs in to the product with any product account (username/password or a Google sign-in with any account), then separately authorizes Google Business with the Google account that manages the Business Profile. They can be different accounts.
Backend responses use the envelope { code: 200, message, data }. Treat code !== 200 as an error and surface message to the merchant.
Token storage (designated location = environment variables). All secrets are kept out of the prompt, URL and logs, and stored in a single designated place: environment variables. Do not hard-code tokens in code/URLs, and never send them as query params. Designated variables:
AUTH_TOKEN — the full Authorization header value for the login/session token (e.g. Bearer ). Set once after Step 1 and reused verbatim for every backend API call and the next session. Re-authorize only when the API returns 401.
GMB OAuth client credentials (client_id/client_secret) are read by the backend from Spring config (spring.security.oauth2...client-id/secret), not by the agent — no env var needed.
Google Business access_token/refresh_token are owned and persisted by the backend in the shop's googleBusinessToken (DB) and auto-refreshed; the agent never stores or forwards these. A once-made GMB connection stays valid.
Token lifetime (checked): login/session JWT is long-lived (jwt.expiration ≈ 7 years). GMB access_token is short-lived (expires_in, typically ~3600s / 1h), refresh_token is long-lived — the backend refreshes automatically.
To read a stored value for diagnostics, print only a masked/truncated version (e.g. first 6 chars), never the full token.

If the agent has NO browser automation (no browser-skill / opencli-browser), do NOT ask the merchant to copy/paste the token. Use the SSO handoff mechanism described in Step 1 — the agent gets the token by polling a backend endpoint, so the merchant only has to complete the sign-in.

Membership / free trial: the 5-day free trial is granted automatically when the merchant creates their first shop — POST /shop/create sets the shop's vipExpireTime = now + 5 days (and vipLevel = basic) on first shop creation. No extra runtime check is needed; the existing VIP logic treats the trial as a valid membership. During the trial (i.e. while vipExpireTime is in the future) auto-reply works without payment. Once vipExpireTime passes and there is no renewed membership, the merchant must subscribe (Stripe) before auto-reply works. Membership status is read from the existing endpoint GET /shop/getCurShop (vip_expire_time / vipLevel); never force payment for a shop whose trial is still active.
Backend base URL & OAuth endpoints (from utils/appConfig.js)
API_BASE_URL = https://apprest.mytruststores.com/adminServer
OAuth login = {API_BASE_URL}/oauth2/authorization/google-autoreply
Connect Google Business = {API_BASE_URL}/oauth2/connectGoogleBusiness?token=&redirectState=

Before You Start - Gather From The Merchant

Ask the merchant (use a checklist/AskUserQuestion style) for:

Does the merchant already have an account in this product? (yes / no)
Which Google account manages (owns or has manager access to) the Google Business Profile they want to use? They authorize with this account during the Google Business connect step — it does NOT have to match the login account.
What is the business / store (the Google Business Profile location) they manage?
Auto-reply preferences: trigger star threshold (1–5), reply language (auto follow customer / zh / en / fr / es / it), shop intro, signature, keywords.

Note: No payment is required up-front. New shops have a 5-day free trial. Do not ask which subscription plan they want until/unless the membership check shows the trial has ended and they are EXPIRED.

Workflow

The onboarding is strictly sequential. Do not skip ahead. After each step, confirm success before moving on.

Step 1 - Log In / Register

The sign-in account does NOT need to be the Google Business owner. Any product account works.

Browser security prompt ("encrypt access / direct access"): workbuddy or the browser may warn because the URL carries a token or uses plain HTTP (http://). To avoid it:

Prefer the SSO handoff (Mode B) below so the URL only contains handoffId — the token never appears in the address bar, so no sensitive-URL warning.

If you must open a URL in the browser, always pick "encrypt access" (HTTPS) — the production base URL https://apprest.mytruststores.com is already encrypted, so this is safe. Do NOT pick "direct access" on plain HTTP.

Recommended path: Google OAuth sign-in (no account-identity constraint).

Build the login URL: {API_BASE_URL}/oauth2/authorization/google-autoreply.
Tell the merchant to sign in with any Google account (there is no requirement that it matches the Business Profile).
The callback carries ?token=; store Bearer as the session token (in web: localStorage; in app: uni storage under key token).
Verify the session is valid:
GET /admin/info (header Authorization: Bearer ) -> expect code === 200 and a user object.

Getting the token automatically — two modes, pick by ability:

Mode A (agent has browser automation): open the login URL, read token from the callback URL, store Bearer .
Mode B (agent has NO browser automation): use the SSO handoff so the merchant never copy/pastes:
POST /oauth2/handoff/create with returnUrl=