Ows
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may install the skill believing it never touches payment workflows, while the included instructions could lead an agent to handle payment status or transaction details.
This fulfillment guidance describes payment API integration and payment records, which conflicts with SKILL.md's security note that there is 'No payment processing' and that transactions occur on the external shop.
## 收款流程 ... 支付宝 | alipay.trade.query ... 微信支付 | pay.orderquery ... PayPal | payment.get ... def confirm_payment(order_id, payment_info):
Remove payment-processing guidance or clearly declare it as an optional, user-approved workflow with scoped payment-provider credentials and data-handling limits.
If auto-bid is enabled, the agent can submit offers containing product, pricing, and shop-link information without a fresh per-bid confirmation.
The code can submit bid content to the OW API when auto-bid is enabled. It is disabled by default and disclosed, but it is still a public business action.
def process_auto_bid(...): ... if not config.get('auto_bid_enabled', False) ... return submit_bid(opportunity, catalog) ... urllib.request.Request(f"{OW_API}/posts", ... method='POST')Keep auto-bid disabled unless you are comfortable with autonomous bidding; require explicit confirmation for each bid when possible.
Users may need to provide third-party API credentials for optional search integrations.
The optional API key is purpose-aligned for marketplace search, but the registry metadata declares no primary credential or required environment variables.
⚠️ MoltsList requires API key (optional feature)
Use least-privilege API keys, avoid sharing account-wide credentials, and document any optional credentials in configuration before use.
Product catalogs, bids, opportunities, shop links, and media may remain on disk and may be reused in later selling tasks.
The skill persists business data locally and sends selected seller/product information to external services; this is disclosed and aligned with the seller workflow.
⚠️ Local data storage: Product catalog, opportunities, bids in state/ ... ⚠️ Shop links and product details transmitted to external APIs
Review the state/ directory periodically, avoid storing unnecessary sensitive documents, and delete old bids or media when no longer needed.
Installing the optional credit skill would add code and behavior outside this review.
The script suggests installing an optional external credit skill that is not part of the supplied artifact set. The instruction is user-directed and not automatically executed.
安装：npx skills add Enze-dai/ow-skills/ow-credit
Review the external credit skill separately before installing it, especially if it will affect bidding or buyer-risk decisions.