Tianmao
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A mistaken action could add the wrong item, use the wrong coupon, or prepare the wrong order preview, although payment is not automated.
The workflow directs browser automation to add selected items to the cart and open checkout/order-preview pages. This is central to the shopping purpose, but it changes account state and should remain user-directed.
browser.click(".tb-btn-addcart") ... browser.click(".cart-checkout")Confirm the exact product, quantity, coupons, address, and total before allowing cart or checkout-preview steps; keep payment manual.
The agent may see or act on account-specific shopping details such as cart contents, coupons, 88VIP pricing, and the selected delivery address.
The skill expects use of the user's logged-in Taobao/Tmall account for cart, coupon, discount, and delivery-address steps. It also asks before login, so this is disclosed and purpose-aligned.
Cart Phase (⚠️ Requires login) ... "请确认是否继续？" ... Add to cart ... Apply 店铺券, 平台券, 88VIP discounts ... Select address
Only log in when needed, monitor the browser session, and avoid sharing more account or address information than necessary.
It may be harder to tell exactly which release the registry entry represents.
The included package files identify version 2.0.0, while the supplied registry metadata reports version 1.2.3. This is a minor provenance/versioning inconsistency, not evidence of malicious behavior.
"version": "2.0.0"
The publisher should align registry and package versions; users can review the installed files before relying on the skill.