1688 Shopkeeper.Bak

• Analyzed: Apr 1, 2026, 4:36 PM
• Findings: 1
• Version: 1.0.0
• Hash: 70134baacb56fc59c1fc02e7e0ad4ba690990411106110706d45e98eca08058d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 1688-shopkeeper skill bundle is a comprehensive tool for managing e-commerce operations on the 1688 platform, including product searching, detail retrieval, and automated publishing to downstream shops (Douyin, Pinduoduo, etc.). The code implements a robust authentication mechanism using HMAC-SHA256 signing for requests sent to the official endpoint (ainext.1688.com). While the skill performs high-privilege actions such as persisting API keys to the local OpenClaw configuration file (~/.openclaw/openclaw.json) and executing 'write' operations for product publishing, these behaviors are explicitly documented and governed by safety instructions in SKILL.md (e.g., mandatory dry-runs). No evidence of malicious intent, unauthorized data exfiltration, or hidden backdoors was found.