ClawHub

大淘客选品工具

v0.1.0

大淘客淘宝客选品与数据服务工具，提供高佣商品筛选、实时榜单、选品数据分析，是淘客推广的基础设施级工具。

⭐ 0· 42·0 current·0 all-time
by@fangshan101-coder
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The name and description match the declared capabilities (high-commission product lists, ranking, analysis, API integration). However, the SKILL.md is purely a high-level spec and does not include any concrete integration steps or required credentials for the promised 'API对接' or real-time data — this is not inherently malicious but is vague and will require additional configuration (API keys / endpoints) to deliver real-time data.
ℹ
Instruction Scope
Runtime instructions are high-level only (features, trigger words, and an output template). The instructions do not tell the agent to read local files, environment variables, or transmit data to third-party endpoints. The document is vague about where data comes from, which gives the agent broad discretion but does not itself include risky actions.
✓
Install Mechanism
No install spec and no code files are present, which minimizes risk — nothing is written to disk or automatically installed by the skill package.
✓
Credentials
The skill declares no required environment variables, credentials, or config paths. If you later connect it to real-time APIs, you should expect API keys or tokens; those are not requested here.
✓
Persistence & Privilege
The skill is not marked 'always' and uses default invocation behavior. It does not request elevated or persistent system privileges.
Assessment
This skill is a high-level specification with no code, no installation, and no requested credentials — it appears coherent and low-risk as-is. Before relying on it for live data, confirm where the real-time product data will come from (which APIs/endpoints) and whether you must supply API keys or credentials. Only provide secrets if you trust the upstream data provider and have a privacy/process statement. Because the source/homepage are unknown, prefer installing only after verifying the author or asking for implementation details (data sources, auth, and privacy) and testing in a safe environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk9775npnwb80wnbvak83r38rj983re5p

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments