YHD
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: yhd Version: 2.0.1 The 'yhd' skill is a shopping assistant for YHD.com (1号店) that provides product search, flash sale tracking, and cart management via browser automation. The skill includes explicit safety boundaries in SKILL.md and README.md, specifically forbidding the agent from performing final payments and requiring user consent before accessing login-protected areas. The logic in index.js is limited to harmless helper functions for timing and membership tiers, and no indicators of data exfiltration or unauthorized execution were found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could add items, apply coupons, or navigate checkout-preview pages during a shopping session, but the artifacts direct it to stop before payment.
The skill documents browser clicks that can change shopping-cart state and open an order preview, while also stating that payment is never automated.
browser.click(".add-to-cart-btn") ... browser.click(".checkout-btn") ... Payment | **Never** | User onlyAsk the agent to confirm before adding items, applying coupons, changing delivery options, or opening checkout preview, and review the final order manually.
Using the skill while logged in may expose shopping account details such as cart contents, coupons, delivery slots, selected address, and order totals to the agent workflow.
Several supported operations require a logged-in YHD account, giving the agent access to account-specific cart, coupon, delivery, and order-preview information.
| **Add to Cart** | ✅ Required | ... | **Apply Coupons** | ✅ Required | ... | **Generate Order Preview** | ✅ Required |
Log in only when you want the agent to help with account-specific shopping tasks, and personally verify cart contents, address, coupons, totals, and payment before completing any purchase.