Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Retail Agent Setup
v1.0.0Onboarding wizard for retail digital employee agents — guides businesses through a 12-step setup to configure a fully operational AI store assistant. Use whe...
⭐ 0· 65·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, and runtime instructions align with a retail onboarding wizard. Included parsing and test-generation scripts (product/policy parsing, scoring, test-case generation) fit the stated purpose. Minor inconsistency: SKILL.md shows use of environment variables (example: INVENTORY_API_KEY, channel credential names) and external webhook endpoints as part of channel setup, but the registry metadata lists no required env vars — this is reasonable for optional/conditional connectors but should be explicit in the manifest.
Instruction Scope
Instructions are detailed and scoped to onboarding tasks: collecting system inventory, importing files (CSV/XLSX/PDF/DOC/images), running parse scripts, configuring channels and escalation, and saving artifacts to agent memory. The skill explicitly warns not to import customer PII into the knowledge base and recommends using API queries for PII — that is good. Still, the agent is instructed to accept file uploads and run parsing scripts on those files; users should confirm where uploaded files and parsed outputs are stored and who/what can access them.
Install Mechanism
No install spec is provided even though the package includes Python scripts and a scripts/requirements.txt. The developer notes require libraries like pandas and pdfplumber in _dev/decisions.md and requirements.txt, but there is no automated install step (pip, brew, or similar). That means runtime failures or manual dependency installation will be required. The absence of an install mechanism is an operational risk and also increases the chance someone will run scripts in an environment without inspecting them first.
Credentials
The registry shows no required environment variables, and the skill does not demand unrelated credentials. However SKILL.md and references use example env var names for connectors (e.g., INVENTORY_API_KEY, WECOM_* , WECHAT_*), and channel setup instructs users to provide API credentials and webhook URLs. This is proportionate to purpose but the manifest should declare optional env vars or clearly document which variables are needed when certain channels/skills are enabled.
Persistence & Privilege
The skill stores onboarding artifacts in the agent's memory under a named key (retail_setup_state) and references saving config objects (role_config, skills_config, etc.). always:false (not force-included) and there is no indication it modifies other skills or system-wide agent settings. Persisting state to agent memory is coherent with resumable onboarding.
What to consider before installing
This skill is consistent with a retail onboarding wizard, but take these precautions before installing or running it:
- Review the included Python scripts (scripts/parse_*.py, gen_test_cases.py, score_knowledge.py) before execution to ensure they do not transmit data externally or perform unexpected network activity.
- The bundle includes scripts/requirements.txt but no install spec — you or your operator must provision a Python runtime and install dependencies (e.g., pandas, pdfplumber) before using the parsing features. Prefer running in a sandboxed environment first.
- Do not upload raw customer PII to the knowledge base. The SKILL.md warns about this; follow it: use API connections for PII or anonymize data prior to import.
- Expect to provide channel credentials (WeCom, WeChat MP, WhatsApp/BSP, inventory API keys) during setup if you enable those connectors. The skill references env var names and webhook URLs; validate where those credentials will be stored and who can access them.
- Verify where agent memory and any temporary files (parsed JSON, OCR outputs) are stored and how long they persist. If your organization has data residency or retention policies, confirm compatibility.
- If you plan to enable autonomous model invocation or allow the agent to run tests/configuration unattended, consider a staged rollout: test with non-sensitive sample data, confirm the test report and guardrails behave as expected, and only then run against production data.
Overall: the skill is plausibly benign in intent, but the missing install/dependency instructions and the presence of executable parsing scripts mean you should inspect and test the code and runtime environment before trusting it with production data or credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk978z2tdv1wz8ghm83s619m6fx83fkjx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🏪 Clawdis