Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Shopee One Click Listing
v1.0.0Shopee one-click product listing and cross-platform publishing agent. Efficiently create, optimize, and publish Shopee listings, enable one-click cross-listi...
⭐ 1· 136·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description promise (one‑click listing + cross‑platform publishing) mostly aligns with the SKILL.md’s content about title, images, pricing, variations and checklists. However, the skill declares no credentials, no API endpoints, and no publish workflow or tooling — so the 'one‑click publish' capability appears unimplemented or delegated to something not described. This is an important inconsistency: either the skill only generates listing content (not actually publish), or it expects a separate connector not documented here.
Instruction Scope
SKILL.md is an instruction-only guide and stays on scope for creating/optimizing listing content, localization, and pricing strategy. It does not instruct reading system files, environment variables, or sending data externally. It does ask the user to provide competitor listings and images (which is normal), but it gives no guidance on how to fetch competitor data or how to authenticate/publish to Shopee or other marketplaces.
Install Mechanism
There is no install spec and no code files — the skill is instruction-only, which minimizes installation risk (nothing will be downloaded or written by the skill itself).
Credentials
The skill requests no environment variables or credentials. Given the claimed ability to publish and cross-list, lack of any authentication or API credential requirements is disproportionate to that claim and suggests either the skill only prepares content or it will later ask for credentials out-of-band. Lack of declared credentials is potentially misleading.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system privileges or to modify other skills. It is user-invocable only, which is appropriate for this kind of assistant.
What to consider before installing
This skill looks useful as a content-creation and optimization guide for Shopee listings, but it does not include any implementation for authenticating to Shopee or performing publishing actions. Before installing or using it expecting 'one-click publish':
- Confirm what 'listing create' / 'cross-publish' actually does in your agent runtime — does it only produce text/images to paste into Shopee, or will it try to call Shopee APIs? If it will call APIs, ask where you must provide credentials and how they are stored.
- Do not provide your Shopee seller credentials or API keys until you verify the integration path and that credentials are stored securely and scoped to the minimum necessary permissions.
- Be cautious about any future version that adds install scripts or code files (downloads, npm packages, or shell commands) — inspect those for network URLs and extract instructions before allowing installation.
- If you expect the skill to fetch competitor data automatically, confirm it does so in a way that obeys marketplaces' terms of service; otherwise supply competitor examples manually.
Given the description/claims vs. the actual content, treat this skill as a listing content assistant (benign for content help) unless/until you see documented, secure publishing connectors; otherwise avoid granting credentials or automation privileges.Like a lobster shell, security has layers — review code before you run it.
latestvk979z8tmz829g43ea89qdskf9583h4y5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.