Waimai Merchant
Security checks across malware telemetry and agentic risk
Overview
This appears to be a local food-delivery merchant management CLI that stores business records on your computer, with no evident hidden network, credential, or deceptive behavior.
Before installing, be comfortable running npm install for a Node/SQLite CLI and storing merchant data locally. When using it, have the agent confirm record IDs and values before price changes, approvals, suspensions, or deletions.
VirusTotal
65/65 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If run with the wrong ID or value, the agent could change or delete local merchant/product records.
The documented CLI can change prices and delete merchant/product records. These actions are purpose-aligned and user-directed, but they can alter local business data.
node dist/index.js product price <id> <new_price> ... node dist/index.js merchant delete <id> ... node dist/index.js product delete <id>
Confirm IDs and requested changes before running update, price, status, or delete commands; back up the local database if records matter.
Installing the skill may run normal package installation scripts from npm dependencies.
The npm dependency tree includes a native SQLite package with an install script. This is expected for better-sqlite3, but npm install executes dependency-supplied installation code.
"node_modules/better-sqlite3": { "version": "9.6.0", ... "hasInstallScript": trueInstall only from a trusted copy of the skill and keep the lockfile intact when running npm install.
Local records may include phone numbers, addresses, emails, contacts, and business-license details.
The skill persists merchant contact and business-license information in a local SQLite database, which is expected for this management tool but may be sensitive business/personal data.
数据存储在: `~/.waimai-merchant/` - `merchant.db` ... phone ... email ... business_license ... contact_person
Treat the database as private business data and avoid sharing command output or database files unless intended.