PDD Shopping
PassAudited by ClawScan on May 1, 2026.
Overview
This is a coherent Pinduoduo shopping-advice skill with disclosed browser and logged-in shopping actions that stop before payment, but users should supervise any cart, group-buy, or checkout-preview steps.
This skill appears safe to install as an instruction-only shopping assistant. Before using logged-in browser features, make sure you want the agent to inspect your Pinduoduo cart, coupons, group-buy options, and order preview, and personally complete any payment or final order submission.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If allowed in a logged-in session, the agent may change the cart or advance a shopping flow up to the order-preview stage, though the artifacts say it must not pay or submit the final order.
The browser workflow documents clicks that can add items to a cart, start or join a group-buy flow, and proceed to checkout preview. These are purpose-aligned shopping actions, but they affect a third-party account state and should remain supervised.
browser.click(".add-cart-btn") ... browser.click(".group-buy-btn") ... browser.click(".checkout-btn")Keep browser actions supervised and require explicit confirmation before add-to-cart, group-buy, coupon, or checkout-preview clicks.
The agent may view or act within a logged-in Pinduoduo session for cart, coupons, group-buy, and order-preview checks.
The skill discloses that several operations require authenticated Pinduoduo access, while final payment is explicitly blocked. This is expected for shopping assistance but involves delegated account privileges.
| Add to cart | Required | ... | Coupon check | Required | ... | Group action | Required | ... | Payment | Blocked |
Use public browsing when possible, only log in when necessary, and avoid exposing unrelated account pages or personal details.
It may be harder to independently verify who authored or maintains the skill.
The registry metadata does not identify a verified source. Because this is instruction-only with no code or install script, this is a provenance notice rather than evidence of unsafe behavior.
Source: unknown
Install from a trusted registry page and review the visible instructions before granting any logged-in browser access.