Daily Deals 1.0.0

每日神价推送服务，自动聚合全网优惠，生成精简报告。适合忙碌的省钱达人、副业套利者。

Security Scan

The skill mostly does what it says (scrape and push daily deals) but contains hard-coded Feishu credentials and absolute paths to another skill's scraper (executes it), which are unexplained and could send your data to the author's endpoint or execute unexpected code on your machine.

Purpose & Capability

The SKILL.md promises user-configurable push webhooks, but multiple runtime scripts (daily-push.js, daily-push-feishu.js) contain hard-coded Feishu appId/appSecret/receiveId and will push reports to the author's Feishu account regardless of user config. The code also depends on an anti-bot-scraper script at an absolute author-specific path (/home/gaof/...), which is not declared in SKILL.md or manifest.

Instruction Scope

Instructions describe saving browser snapshots and running the provided scripts, but the runtime code calls execSync to run another skill's scraper (external script path) and reads/writes files under /tmp and the skill's assets directory. The SKILL.md does not mention the exact dependency path or the embedded Feishu push behavior—granting the skill broader capability than the documentation indicates.

Install Mechanism

There is no install spec beyond 'npm install' in SKILL.md. package.json depends on playwright (heavy browser binaries), which is consistent with scraping but will download browsers during install. No remote arbitrary archive downloads were found.

Credentials

requires.env declares none, but scripts contain sensitive hard-coded credentials (Feishu appSecret/appId/receiveId). The skill will contact external endpoints (Feishu APIs and webhook URLs). Hard-coded credentials and undocumented external recipients are disproportionate to a user-run deal-aggregation skill and risk leaking scraped/report data to a third party.

Persistence & Privilege

always is false and the skill does not request system-wide persistence. However, it executes other code via execSync using a hard-coded path to another skill, which could run arbitrary code under the agent user's account if that path is present or replaced.

What to consider before installing

Key risks: the scripts contain hard-coded Feishu credentials (appId/appSecret/receiveId) that will send reports to the author's Feishu account; and several scripts execute an anti-bot-scraper using an absolute path (/home/gaof/.../anti-bot-scraper...), which may run arbitrary code. Before installing/runing: 1) Inspect and remove or replace the FEISHU_CONFIG lines in scripts/daily-push.js and scripts/daily-push-feishu.js (or ensure they use only your configured webhooks in config/config.json). 2) Search for and do not execute unknown external scripts—verify the anti-bot-scraper path or change scraper calls to a trusted scraper under your control. 3) If you run npm install, be aware playwright will download browser binaries; run in an isolated environment if you distrust network calls. 4) Prefer using scripts/push-report.js with your own webhook config (it respects config/config.json) rather than the hard-coded Feishu push routines. 5) If unsure, run the generator offline (use local snapshot files) and avoid letting the skill call remote endpoints until you remove hard-coded credentials and absolute external-path execs.

每日神价推送

自动聚合全网优惠，每日定时推送精简报告。

功能

1. 定时推送: 每日 8:00/20:00 自动发送
2. 全网聚合: 淘宝/京东/拼多多/什么值得买
3. 智能筛选: 只推送真正的神价（折扣>30%）
4. 分类整理: 数码/服饰/家居/食品
5. 利润测算: 附带套利空间计算

安装

# 安装依赖
cd ~/.openclaw/skills/daily-deals-1.0.0
npm install

# 配置推送渠道（微信/钉钉/飞书）
cp config/config.example.json config/config.json
# 编辑 config.json 填写你的 webhook

使用

手动运行

# 生成今日神价报告
node scripts/generate-report.js

# 推送到配置好的渠道
node scripts/push-report.js

定时任务（推荐）

# 添加到 cron，每日 8:00 和 20:00 推送
0 8,20 * * * cd ~/.openclaw/skills/daily-deals-1.0.0 && node scripts/daily-push.js

自定义配置

编辑 config/config.json:

{
  "categories": ["digital", "clothing", "home", "food"],
  "minDiscount": 0.3,
  "platforms": ["jd", "taobao", "pdd", "smzdm"],
  "pushChannels": ["wechat", "dingtalk"],
  "webhooks": {
    "wechat": "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=xxx",
    "dingtalk": "https://oapi.dingtalk.com/robot/send?access_token=xxx"
  }
}

输出示例

📦 每日神价日报 2026-03-24

🔥 今日 TOP10 神价

【数码】
1. iPhone 17 128G - ¥4,429（日常¥5,999）
   平台：京东 | 折扣：74折 | 省¥1,570
   套利空间：拼多多售价¥4,999，毛利¥570

2. RTX 5060Ti 8G - ¥2,899（日常¥3,699）
   平台：京东 | 折扣：78折 | 省¥800

【服饰】
3. 优衣库羽绒服 - ¥199（日常¥599）
   平台：天猫 | 折扣：33折 | 省¥400

📊 今日统计：
- 监控商品：5000+
- 神价数量：47
- 平均折扣：65折
- 最大折扣：25折

💡 套利建议：
今日数码类价差较大，建议关注 iPhone/显卡

数据来源

• 什么值得买（SMZDM）
• 京东百亿补贴
• 淘宝特价版
• 拼多多百亿补贴

技术栈

• Stealth Scraper（反爬虫抓取）
• Node.js
• Cron（定时任务）

作者

Created by OpenClaw