OPC商城

• Risk level: Low
• Analyzed: Apr 24, 2026, 4:48 AM
• Findings: 0
• Version: 1.0.3

Overview

The skill's behavior matches its description (it uses curl to call the listed e‑commerce endpoints and asks for phone/consignee/address to place orders), but it will transmit personal contact data to an external domain (tools.gangzheng.tech) and the source/homepage is unknown — so verify trust before use.

This skill appears coherent for browsing products and placing orders, but it will ask for and send personal contact details (phone number, recipient name, delivery address) to https://tools.gangzheng.tech. Before installing or using it: (1) confirm you trust that domain/operator (there's no homepage listed); (2) insist the agent asks for explicit permission before making any POST/order call (avoid silent or automatic ordering); (3) consider testing with non-sensitive dummy data first; (4) avoid entering highly sensitive addresses or payment tokens here; (5) if you don't want the agent to act autonomously to place orders, disable autonomous invocation or require explicit user confirmation for actions that transmit PII. If you need attribution or a privacy policy for the service, get that from the skill author before using with real customer data.