ClawHub

Taobao Native CLI

v1.0.41

Shopping assistant via Taobao Desktop client. Use when the user needs to search products, view details, add to cart, place orders, check orders, request ship...

⭐ 1· 446·7 current·7 all-time
byshenbin@flappymonkey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (Taobao Desktop CLI helper) match the declared requirements: it requires the local taobao-native binary and references Taobao-specific config paths (%APPDATA%/taobao/... and ~/Library/…/taobao-runner). Those requirements are appropriate for a desktop-CLI based shopping assistant.
ℹ
Instruction Scope
SKILL.md tells the agent to run local taobao-native commands, read/write result files (recommended into the task workspace), read the declared install-location file and the taobao-runner path, and to refresh PATH in-session as a fallback. These actions are within the skill's stated purpose, but they do permit the agent to execute local CLI commands and update the session PATH (non-persistent). The doc explicitly says not to auto-install unless the user requests, which limits scope creep.
ℹ
Install Mechanism
There is no automated install spec in the skill bundle (instruction-only). A reference file documents an official-looking CDN download URL (tblifecdn.taobao.com) and silent install commands as a user-initiated procedure. Downloading and running executables is higher-risk in general, but here it is described as manual/user-initiated; the presence of a vendor CDN link is expected for this purpose. If you allow the agent to perform installs, that increases risk.
✓
Credentials
The skill requests no environment variables or credentials. The only requested local artifacts are the two Taobao-specific config paths and the presence of the taobao-native binary, which are proportionate to its functionality.
✓
Persistence & Privilege
The skill is not forced-always, does not request persistent/privileged system changes, and does not attempt to modify other skills or system-wide agent settings. It suggests temporarily updating the session PATH for command discovery, which is non-persistent and reasonable for its purpose.
Assessment
This skill appears to do what it says: control a locally installed Taobao desktop CLI. Before installing or enabling it, confirm you have (or want) the official Taobao desktop client installed locally. The skill may run local taobao-native commands and write output files to the agent workspace, and it includes instructions (only with user consent) to download and run a Taobao installer from tblifecdn.taobao.com — treat that like any installer: verify the URL and perform installs yourself rather than allowing an autonomous agent to download/execute binaries. The skill does not request credentials, but it can execute local CLI operations — only enable it in environments where you trust those operations and where writing result files to the workspace is acceptable.

Like a lobster shell, security has layers — review code before you run it.

latestvk97arksdmjmqrwnt8v73wsdym984kdbh

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

OSWindows · macOS
Any bintaobao-native
Config%APPDATA%/taobao/install-location.txt, ~/Library/Application Support/taobao/cli/taobao-runner

Comments