Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

daily-deals-1.0.0

v1.0.0

每日神价推送服务,自动聚合全网优惠,生成精简报告。适合忙碌的省钱达人、副业套利者。

0· 100·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for gf1023456/daily-deals.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "daily-deals-1.0.0" (gf1023456/daily-deals) from ClawHub.
Skill page: https://clawhub.ai/gf1023456/daily-deals
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install daily-deals

ClawHub CLI

Package manager switcher

npx clawhub@latest install daily-deals
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims full-site aggregation (Taobao/JD/PDD/1688), scheduled pushes, and WeChat delivery, but the package is instruction-only and only declares python3 as a requirement. There are no declared API keys, webhooks, payment integration, or scraping/runtime components. A real implementation would normally require credentials, API endpoints, scraping code, or a service that performs scheduling/delivery — none are present. Also _meta.json.ownerId differs from the registry Owner ID, which is an additional inconsistency.
!
Instruction Scope
SKILL.md contains high-level user prompt examples and an example report but no runtime instructions for how to gather prices, authenticate to marketplaces, or deliver messages to WeChat. The instructions are vague (e.g., '订阅每日神价推送,发送到我的微信') and give the agent broad, undefined discretion to act, which could cause it to ask for credentials or attempt ad-hoc scraping without boundaries.
Install Mechanism
There is no install spec and no code files; this is the lowest-risk installation pattern because nothing will be written to disk by an installer. However, the lack of an implementation also creates ambiguity about how promised features will be achieved.
!
Credentials
The skill declares no required environment variables or credentials despite promising WeChat delivery and interactions with multiple e-commerce platforms. Those capabilities normally require tokens, cookies, or API keys (and possibly proxies). The absence of any declared credentials is disproportionate and unexplained.
Persistence & Privilege
The skill does not request always:true and is user-invocable. There is no indication it will modify global agent settings or persist credentials automatically.
What to consider before installing
This skill appears to be a high-level description rather than an implemented integration. Before installing or using it: - Ask the publisher for the actual implementation (code, install instructions, and where it runs). Do not install unless you can review the code. - Request details on how scheduling and WeChat delivery are implemented and where credentials are stored; require explicit env var names and storage/rotation policies. Never paste your WeChat account credentials into a skill without knowing how they will be used and stored. - Verify the data sources and scraping approach (APIs vs. screen-scraping) and confirm compliance with marketplace terms of service and local law. - Confirm the owner identity (metadata mismatch observed) and prefer skills with a verifiable repository, release artifacts on a known host, and explicit install scripts. - If you proceed, run it in an isolated environment and monitor outbound network requests; ask for a minimal permission set and proof that paid features don't require providing more sensitive credentials than necessary.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📦 Clawdis
Binspython3
latestvk97bvejye19q9ghkav2496644d83jkxs
100downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

每日神价推送

自动聚合全网优惠,每日定时推送精简报告。

功能

  1. 定时推送: 每日 8:00/20:00 自动发送
  2. 全网聚合: 淘宝/京东/拼多多/1688
  3. 智能筛选: 只推送真正的神价
  4. 分类整理: 数码/服饰/家居/食品
  5. 利润测算: 附带套利空间计算

使用方式

订阅日报:

订阅每日神价推送,发送到我的微信

自定义品类:

我只想看数码和家居类的神价

设置阈值:

只推送折扣超过 50% 的商品

查看历史:

查看昨天的神价报告

输出示例

📦 每日神价日报 2026-03-24

🔥 今日 TOP10 神价

【数码】
1. iPhone 15 128G - ¥4,299(日常¥5,999)
   平台:拼多多 | 折扣:72 折 | 省¥1,700
   套利空间:淘宝售价¥4,899,毛利¥600

2. 小米手环 8 - ¥149(历史低价¥169)
   平台:京东 | 折扣:88 折 | 省¥20

【服饰】
3. 优衣库羽绒服 - ¥199(日常¥599)
   平台:天猫 | 折扣:33 折 | 省¥400

【家居】
4. 小米空气净化器 - ¥499(日常¥799)
   平台:淘宝 | 折扣:62 折 | 省¥300

📊 今日统计:
- 监控商品:5000+
- 神价数量:47
- 平均折扣:65 折
- 最大折扣:25 折(BUG 价已下架)

💡 套利建议:
今日数码类价差较大,建议关注 iPhone/小米产品

变现模式

  • 免费:每日 1 次推送,基础品类
  • 付费 (¥19/月):每日 2 次 + 全品类 + 套利建议
  • 付费 (¥49/月):实时推送 + 定制阈值 + 导出功能

优势

  • ✅ 被动收入(订阅制)
  • ✅ 用户粘性高
  • ✅ 边际成本低
  • ✅ 易传播

声明: 优惠信息来自公开数据,价格可能随时变动。

Comments

Loading comments...