1688 Shopkeeper

1688选品铺货专家。用于：(1) 在1688搜索商品/选品找货源 (2) 查询已绑定的下游店铺 (3) 将商品铺货到抖音/拼多多/小红书/淘宝等平台 (4) 配置1688 AK密钥。 触发词：帮我找商品、在1688搜、选品、铺货、上架、查店铺、配置AK、1688找货。

Security Scan

The skill is largely coherent with its stated 1688 search-and-publish purpose, but it asks the user to paste their ALI_1688_AK into chat and persists that secret to the OpenClaw Gateway or a local config file (~/.openclaw/openclaw.json) — behavior that isn't fully declared in metadata and has privacy implications.

Purpose & Capability

Name/description match the code: the package implements search, list shops, publish, configure AK and uses an ALI_1688_AK credential and python3. Required binaries and the single main credential (ALI_1688_AK) are appropriate for the described 1688 integration.

Instruction Scope

SKILL.md instructs the agent to extract the user's AK from a chat message and run `cli.py configure <AK>` (and to prefix subsequent commands with ALI_1688_AK=<AK> for the current session). That flows secret material through the chat and into CLI/config scripts — expected for this skill but high-risk in practice. The skill also requires reading local reference files (which are bundled) before executing some commands; that is fine.

Install Mechanism

There is no remote install spec (instruction-only), and bundled code is pure Python using only the `requests` dependency. No downloads from arbitrary URLs or extract operations are present. README suggests installing from a GitHub URL, but the distributed package already contains the code. This is low-to-moderate install risk.

Credentials

Declared required env var is ALI_1688_AK (primary credential) which matches the purpose. However the code also reads and uses other environment variables (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, OPENCLAW_WORKSPACE_DIR) but these are not listed in the metadata. The configure flow will attempt to send the AK to the Gateway URL (default http://localhost:18789) or write it into ~/.openclaw/openclaw.json — both persist the secret. That persistence and the undocumented gateway env vars are proportional for functionality but should have been declared and explicitly documented as storing the AK.

Persistence & Privilege

always:false (good). The skill intentionally modifies the agent configuration by writing the AK into the Gateway config or into ~/.openclaw/openclaw.json (fallback). Modifying its own skill entry in the gateway/config is expected for 'configure' behavior, but it does persist a sensitive secret on disk and/or push it to the configured Gateway endpoint; the metadata did not declare a required config path, which is an inconsistency to be aware of.

What to consider before installing

This skill appears to implement the advertised 1688 search and publish features, but it requires your ALI_1688_AK secret and will persist it either by calling the OpenClaw Gateway API or by writing to ~/.openclaw/openclaw.json. Before installing or using it: - Only provide your AK if you trust the skill's source; the package owner is unknown here. Prefer to set ALI_1688_AK yourself in your environment rather than pasting it into chat. - Understand where the AK will be stored: configure.py will PATCH OPENCLAW_GATEWAY_URL (defaults to http://localhost:18789) if available, or fall back to writing the key into ~/.openclaw/openclaw.json. If your gateway URL is not local, the AK could be sent to that endpoint — verify OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN before use. - Check file permissions on ~/.openclaw/openclaw.json if the skill writes to it; storing secrets on disk can be a privacy risk if other users/processes can read them. - If you do not want the skill to persist the AK, set ALI_1688_AK in your environment manually for the session (export ALI_1688_AK=...) and avoid using the 'configure' command that writes it. - If possible, review the bundled code (especially configure.py and _auth.py) and confirm the gateway URL and behavior are acceptable. Prefer obtaining this skill from a known/trusted upstream repository or maintainer. If you want, I can point out the exact lines that write the AK to disk or call the gateway, or produce a safe checklist to configure the skill without persisting secrets.

统一入口：python3 {baseDir}/cli.py <command> [options]

命令速查

命令	说明	示例
search	搜商品	cli.py search --query "连衣裙" --channel douyin
shops	查绑定店铺	cli.py shops
publish	铺货	cli.py publish --shop-code CODE --data-id ID
configure	配置 AK	cli.py configure YOUR_AK
check	检查配置状态	cli.py check

所有命令输出 JSON：{"success": bool, "markdown": str, "data": {...}} 展示时直接输出 markdown 字段，Agent 分析追加在后面，不得混入其中。

标准流程

选品→铺货：check → search → 用户筛选(Agent 推荐 + 用户确认) → shops → publish 首次使用：check → 按 data 字段分支：

• ak_configured: false → 先 configure（优先级最高，其他命令都依赖 AK）
• shops_count: 0 → 引导开店
• expired_count > 0 → 提示重新授权
• 全部正常 → 进入选品流程

刚配置 AK：当前会话命令前加 ALI_1688_AK=xxx，重启 Gateway 后全局生效

执行前置（必须）

• 执行 search 前：先完整阅读 references/search.md
• 执行 shops / publish 前：先完整阅读 references/publish.md
• 执行 configure 前：先完整阅读 references/configure.md

AK 引导话术

"需要先配置 AK。打开 1688 AI版 APP（没装的话点链接下载），首页点击「一键部署开店Claw，全自动化赚钱🦞」，进入页面获取 AK，然后告诉我：'我的AK是 xxx'"

开店引导话术

"还没有绑定店铺。打开 1688 AI版APP → 首页「一键开店」，开好后告诉我。"

FAQ 经营知识（按需加载）

用户问经营问题时，先加载对应文件再回答，不凭经验泛泛而谈。

用户话题	加载文件
选哪个平台、抖店/拼多多/淘宝	references/faq/platform-selection.md
选品风险、品类、节日选品	references/faq/product-selection.md
运费模板、定价、加价倍率	references/faq/listing-template.md
发货超时、中转费、偏远地区	references/faq/fulfillment.md
退货、仅退款、运费险、售后	references/faq/after-sales.md
新店破零、服务分、推广	references/faq/new-store.md
素材审核、白底图、标题优化	references/faq/content-compliance.md