Secure Shopper

This skill appears to do what it says (shop, use secure-autofill, save results) but has packaging and disclosure issues you should address before installing. Specifically: - The helper scripts write artifacts to a hard-coded path (/home/miles/.openclaw/workspace/...), which reveals a user-specific path and will not work correctly for other users — ask the author to make this path configurable or relative to the current agent/workspace. - The SKILL.md depends on a separate secure-autofill skill and mentions gateway environment variables (and a non-headless Chrome) but the manifest declares no required env vars or config paths; confirm what secrets or environment variables secure-autofill actually needs and whether those will be present and limited in scope. - The skill uses vault_suggest/vault_fill to access credentials via secure-autofill. Verify you trust the secure-autofill implementation and understand which credentials it will expose and under what conditions (ensure explicit user confirmation before any checkout or purchase action). - Because the skill spawns sub-agents that browse and can log in, test it in a safe/isolated environment (or with test accounts) first to confirm it respects the stated 'accept/deny' gate and doesn't place orders autonomously. If you plan to use it: require the author to (1) remove hard-coded paths or make them configurable, (2) declare required env vars/config paths in the skill manifest, (3) document exactly what secure-autofill vault operations occur, and (4) provide a reproducible way to run onboarding that does not assume a specific home directory. If those changes are not made, treat installation as higher risk.