commercial-market-report

Before installing or running this skill, consider the following: 1) The SKILL.md requires API keys (Tavily, Amap, possibly BRAVE_SEARCH) and instructs reading ~/.openclaw/.env, but the skill metadata declares no required env vars—ask the author to explicitly list required credentials and explain how they are used and stored. 2) The skill performs web scraping (Xiaohongshu via Chrome remote-debugging and Sogou via web_fetch). Enabling Chrome with --remote-debugging-port exposes browser debugging endpoints—only do this in a controlled/sandboxed environment and avoid exposing personal profiles or active logins. 3) Verify where API keys are sent: the scripts included are local and do not show outbound network calls, but the instructions expect the agent to call external APIs; confirm that keys will not be exfiltrated to unknown endpoints and that TLS and proper Authorization headers are used. 4) If you must provide API keys, prefer scoping them with least privilege and use short-lived or restricted credentials if possible. 5) Ask the author to update the skill metadata to declare required env vars and to document data retention, logging, and any external third-party skills invoked (e.g., amap-lbs-skill, multi-search-engine). 6) If you cannot get satisfactory answers, run the skill in an isolated environment (separate user account or VM) and do not enable remote debugging on a machine with sensitive data.