Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

XiaomiYe

v1.0.0

人人商城龙虾助手 - 人人商城数据查询与订单管理工具。 当用户提到以下意图时使用此技能: 「查待办事项」「查运营数据」「查商品信息」「查会员信息」 「查订单」「管理订单」「查优惠券」「设置满额包邮」 「配置商城API」「验证API连通性」 支持:待办事项查询、运营数据统计、商品/会员/订单全维度查询、优惠券管理、...

0· 181·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jishuweihu/syxx.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "XiaomiYe" (jishuweihu/syxx) from ClawHub.
Skill page: https://clawhub.ai/jishuweihu/syxx
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install syxx

ClawHub CLI

Package manager switcher

npx clawhub@latest install syxx
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Skill name, description, declared primary credential (RR_CLAW_API_KEY) and the client code (request_client.py) all align with a 人人商城 API helper. However there are packaging inconsistencies: the registry summary lists no required env vars while SKILL.md metadata declares requiredEnv: RR_CLAW_BASE_URL; _meta.json shows a different ownerId/slug/version than the registry metadata. These mismatches are likely benign (packaging mistakes) but should be clarified.
Instruction Scope
SKILL.md instructs the agent to send requests only to the user-configured RR_CLAW_BASE_URL, to use the provided API key in an Authorization header, and to confirm before any destructive operations. The included client wrapper only performs HTTP calls and JSON checks and does not read arbitrary files or attempt exfiltration. The SKILL.md does reference a platform-secret file (~/.openclaw/openclaw.json) but states the platform injects secrets and the skill code receives them via parameters (the client code does not read that file).
Install Mechanism
There is no install spec (instruction-only + a small Python helper file). The metadata suggests Python with requests>=2.31.0; the code depends only on requests. No remote downloads or obscure installers are used.
!
Credentials
Requested credential (RR_CLAW_API_KEY) and a base URL are proportionate to the skill's stated purpose. Concern: metadata inconsistency — SKILL.md declares RR_CLAW_BASE_URL as requiredEnv while the registry summary listed none; primaryEnv is set to RR_CLAW_API_KEY. Confirm which envs/secret injection the platform will actually provide before installing.
Persistence & Privilege
Skill does not request always:true or system-wide privileges, and there are no instructions to modify other skills or system settings. The client keeps an in-process singleton but does not persist credentials itself.
What to consider before installing
What to check before installing: - Confirm source/trust: verify the skill homepage and the publisher; the package metadata contains conflicting ownerId/slug/version values which suggests packaging or distribution mistakes. - Confirm which environment values the platform will actually inject (RR_CLAW_API_KEY and RR_CLAW_BASE_URL are referenced in SKILL.md). Do not place high-privilege keys in world-readable files. - Ensure the platform enforces that HTTP requests are limited to the configured RR_CLAW_BASE_URL (the skill asserts this but you should verify network policy/logging on your platform). - Review the included scripts/request_client.py (it's small and simply wraps requests), and confirm there are no hidden endpoints — the client only uses Authorization header and standard GET/POST to base_url. - Treat destructive actions (close order, stop coupon, take product off-shelf, close free-shipping) as sensitive: confirm the skill will always ask for explicit user confirmation before calling those POST endpoints. - If you lack confidence in the publisher, request a corrected package with consistent metadata and an explicit manifest of required env vars before enabling the skill. If these checks are satisfied the skill appears coherent for its stated purpose; if the packaging/metadata discrepancies remain unexplained, avoid enabling it until clarified.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Primary envRR_CLAW_API_KEY
latestvk976z4qj4wfeebj9xeh1xr802s8378tx
181downloads
0stars
1versions
Updated 19m ago
v1.0.0
MIT-0

人人商城龙虾助手

一、必读约束

首次安装配置

~/.openclaw/openclaw.json 中添加凭证,平台启动时会自动读取该文件并将凭证注入技能运行上下文(技能代码本身不直接读取此文件):

{
    "skills": {
        "entries": {
            "renren-claw": {
                "apiKey": "你的RR_CLAW_API_KEY",
                "env": {
                    "RR_CLAW_BASE_URL": "你的人人商城API基础地址"
                }
            }
        }
    }
}

获取凭证:前往 [人人商城后台 > 插件 > 龙虾助手 > API Key管理] 获取 API_KEY服务器地址

安全约定

  • 你操作的是用户线上的电商系统,任何失误都可能造成用户的经济损失
  • 操作类接口提交时一定与用户确认好之后再进行操作
  • 技能运行时仅向用户配置的 RR_CLAW_BASE_URL 发送请求,不会将 API Key 传输至任何第三方端点
  • 严禁在聊天消息中明文输出 API Key

二、认证与请求方式

请求头

  • Authorization: Bearer $RR_CLAW_API_KEY(格式:lh-xxxxxxx-oc

请求方式

  • GET:查询类接口
  • POST:提交数据 / 操作类接口,请求体以 application/x-www-form-urlencoded 格式提交

请求接口格式

RR_CLAW_BASE_URL + 接口地址

举例:https://example.com/wap/25/api/apps/openClaw/statistics/overview/to-do

响应数据格式

  • 所有接口统一返回 HTTP 200,禁止以 HTTP 状态码判断成功或失败
  • 响应格式为 JSON:{"error": 0, "message": "success", ...}
  • 必须检查 error 字段0 = 成功,非 0 = 业务失败(message 中包含错误描述)

脚本请求示例

凭证由平台从 ~/.openclaw/openclaw.json 注入,通过参数传递给客户端:

可自行拼接 cURL 请求,或调用 scripts/request_client.py 封装的客户端:

from request_client import get_client

# 首次初始化:传入平台注入的凭证
client = get_client(base_url=RR_CLAW_BASE_URL, api_key=RR_CLAW_API_KEY)

# 后续调用直接复用已初始化的单例
client = get_client()
client.get("/some/path")

三、快速决策

用户意图用户示例问法调用接口请求参数
数据统计模块
查询待办事项"待办事项"、"今天待办"、"待发货多少"GET /statistics/overview/to-do
查询今日运营数据"今日销售额"、"今天运营数据"GET /statistics/overview/operationalperiod=today
查询昨日运营数据"昨天销售额"、"昨日数据"GET /statistics/overview/operationalperiod=yesterday
查询近7天运营数据"近7天运营数据"GET /statistics/overview/operationalperiod=week
查询近30天运营数据"近30天数据"GET /statistics/overview/operationalperiod=month
新增会员统计"今日新增会员"、"近7天新会员"GET /statistics/overview/new-memberperiod=today
新增订单统计"今日订单数"、"近7天订单趋势"GET /statistics/overview/new-orderperiod=today
浏览量分析"今日浏览量"、"近7天PV/UV"GET /statistics/overview/view-dataperiod=today
商品销量排行"销量排行榜"、"什么卖得好"GET /statistics/overview/goods-rankperiod=today
会员消费排行"会员消费榜"、"谁消费最多"GET /statistics/overview/member-rankperiod=today
商品基础数据统计"近30天商品浏览加购数据"GET /statistics/goods/basicstart_time、end_time(可选)
商品模块
查询商品列表"搜索iPhone"、"找商品"GET /goods/list/getkeywords(可选)
获取商品详情"商品ID 184的详情"GET /goods/detail/getid=184
下架商品"下架商品ID 184"POST /goods/operation/put-storeid=184
会员模块
查询会员列表"搜索会员An"、"找会员"GET /member/list/getkeywords(可选)
获取会员详情"会员ID 317的详情"GET /member/list/getid=317
通过手机号查会员ID"手机号15888888888的会员ID"GET /member/index/get-id-by-mobilemobile=15888888888
订单模块
查询订单列表"查订单"、"待发货订单"GET /order/list/getstatus(可选)
通过订单号查订单ID"订单号xxx的ID"GET /order/index/get-id-by-noorder_no=xxx
查询订单状态"订单xxx现在什么状态"GET /order/index/get-statusorder_no
查询订单物流"订单xxx的物流信息"GET /order/index/get-expressorder_no
关闭待支付订单"关闭订单ID 184"POST /order/operation/closeid=184
营销活动模块
优惠券概览"优惠券数据概览"GET /sales/coupon/overview
查询优惠券列表"搜索优惠券"、"发放中的优惠券"GET /sales/coupon/listkeywords(可选)
停止发放优惠券"停止发放优惠券ID 184"POST /sales/coupon/manual-stopid=184
获取满额包邮设置"满额包邮设置"GET /sales/full-free/get
关闭满额包邮"关闭满额包邮"POST /sales/full-free/close

四、功能列表

数据统计模块

读取 数据统计模块 的接口文档。

商品查询管理模块

读取 商品查询管理模块 的接口文档。

订单查询管理模块

读取 订单查询管理模块 的接口文档。

会员查询管理模块

读取 会员查询管理模块 的接口文档。

营销活动查询管理模块

读取 营销活动查询管理模块 的接口文档。

五、意图判断指南

商城字段名词解释

字段名说明
goods商品
member会员
order订单
shop店铺
mall综合商城
communityBuy社区团购
siteApp智慧轻站
promoter推客带货

时间段判断

用户提到period参数值
今天、今日today
昨天、昨日yesterday
近7天、一周、最近7天week
近30天、一月、最近30天month

功能关键词判断

关键词对应功能
待办、待发货、待付款、待审核待办事项接口
销售额、成交金额、运营数据、客单价运营数据接口
新增会员、新会员新增会员统计接口
新增订单、订单数新增订单统计接口
浏览量、PV、UV、访问量浏览量分析接口
销量、排行、卖得好、商品排行商品销量排行接口
会员消费、消费榜、谁消费最多会员消费排行接口
商品、搜索商品、找商品商品列表接口
会员、搜索会员、找会员会员列表接口
订单、查订单、订单状态订单列表接口
物流、快递、物流信息订单物流接口
优惠券优惠券相关接口
满额包邮满额包邮相关接口

⚠️ 危险操作(必须二次确认)

以下接口会直接影响线上业务,执行前必须向用户明确确认,禁止自动执行

  • POST /goods/operation/put-store — 下架商品(影响前台展示)
  • POST /order/operation/close — 关闭订单(不可逆)
  • POST /sales/coupon/manual-stop — 停止发放优惠券(立即生效)
  • POST /sales/full-free/close — 关闭满额包邮(立即生效)

Comments

Loading comments...