Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ecommerce Automation
v1.0.0Automate e-commerce operations: price monitoring, inventory tracking, order management, competitor analysis, and stock alerts. Save 20+ hours per week for on...
⭐ 0· 485·2 current·2 all-time
byFuhaolin@fuczy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims integrations with Shopify, Amazon, eBay, Slack, email, SMS, etc., which fits the stated purpose, but the declared binaries/requirements don't align with the instructions (see instruction_scope). Some required capabilities (API keys, webhooks) are implied in the SKILL.md but not declared in requires.env or metadata.
Instruction Scope
SKILL.md instructs users to create config files containing API keys and to run CLI commands (examples use 'clawhub workflow ...'), to scrape competitor sites (URL + CSS selectors) and to send alerts to external channels. The doc does not explain how credentials for Slack/email/SMS/Amazon are supplied or protected, nor does it provide rate-limit/legal guidance for scraping. Critically, the instructions use the 'clawhub' CLI while the metadata requires 'openclaw' as a binary — an incoherence that will break execution or hide unexpected behavior.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer. That lowers surface area. However, runtime use depends on an external CLI (clawhub/openclaw) that must exist on the system.
Credentials
The skill implies the need for multiple sensitive credentials (Shopify API keys, Amazon seller credentials, Slack webhooks, email/SMS gateway credentials) but declares no required env vars or a primary credential. That mismatch means users could be prompted to place secrets in config files with unclear handling, increasing risk of accidental leakage.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent/system-wide privileges. Nothing in the manifest requests elevated persistence.
What to consider before installing
Do not install or provide credentials yet. Ask the publisher for clarification and source: (1) confirm which CLI is required ('clawhub' vs 'openclaw') and provide the official distribution/source for that binary; (2) request the actual code or a link to a vetted repo so you can review how credentials from ecommerce-config.yaml are stored and transmitted; (3) verify how alerts (Slack/email/SMS) are authenticated and where secrets are kept; (4) avoid pasting production API keys into a config until you confirm secure handling (use least-privilege keys or a sandbox account); (5) if you plan to use competitor scraping, verify rate-limiting, robots.txt/legal constraints, and that scraped data won't be exfiltrated elsewhere; (6) test in an isolated environment first. These inconsistencies (binary name mismatch and undeclared but necessary credentials) are the main reasons this skill appears suspicious rather than benign.Like a lobster shell, security has layers — review code before you run it.
latestvk9782r6xgn049y4qe58bc287s58323z5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛒 Clawdis
Binsopenclaw, curl