Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Jd Search

Execute keyword-based product searches on JD Gongcai Cloud with filters for category, price, pagination, and return results in multiple formats.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 0 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to be a CLI wrapper for JD Gongcai search APIs and the SKILL.md documents exactly those internal endpoints (http://vproxy-search.jd.local/, http://gcy.p-search.jd.local/). That capability is coherent with the name/description. However, the package metadata and README disagree about implementation (package.json declares a Node CLI, README mentions a Python dependency and a ./jd-search script), and the file manifest does not include an actual jd-search executable. These mismatches mean the published bundle does not contain the runtime it advertises.
Instruction Scope
SKILL.md limits runtime behavior to forming HTTP GET requests against JD internal endpoints and formatting results. It does not instruct the agent to read unrelated files or credentials. Caveat: the endpoints are internal-only hostnames — calling them from a machine that has network access could expose internal data or fail outside JD's network. The instructions do not attempt data exfiltration to third-party hosts.
Install Mechanism
No install spec is present (instruction-only), which is low risk. But README shows installation steps that reference an executable path (/Users/zhangrongfa/.joyclaw/...) and symlinking a jd-search binary; that script is not present in the published files. This suggests incomplete packaging or missing artifacts rather than a standard, installable release.
Credentials
The skill declares no required environment variables, credentials, or config paths — appropriate for a simple HTTP search wrapper. No undeclared env access is instructed in SKILL.md. Note: README contains a user-specific absolute path which is irrelevant but indicates this copy may have been packaged from a developer workspace.
Persistence & Privilege
always:false and no special privileges are requested. The skill does not request persistent system-wide changes in its manifest. Autonomous invocation is allowed (platform default) but not accompanied by other red flags.
What to consider before installing
This skill appears to document a JD-internal CLI for searching private JD services, but the published bundle is inconsistent: package.json suggests a Node CLI, README mentions Python and an executable at a local developer path, yet the actual executable file is missing. Before installing or running anything: 1) Don’t run unreviewed binaries — request the jd-search script/source code and inspect it. 2) Confirm the skill’s origin and whether you’re on JD’s internal network (the endpoints are internal-only and will fail or may expose internal data if reachable). 3) Ask the author to provide a complete, reproducible package (source code, build/install steps) or a published release URL (GitHub releases). 4) If you cannot verify the code, avoid symlinking or executing unknown files and do not run network calls to internal hostnames from an environment you don’t trust.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97b56h4h0z3zckw82jd0wf59583yvem

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

JD Search Skill - 工采云垂搜接口封装

概述

封装京东工采云垂搜搜索接口,支持关键词搜索、类目筛选、价格过滤等功能。

接口信息

  • 接口地址: http://vproxy-search.jd.local/
  • 后台域名: http://gcy.p-search.jd.local/
  • 调用方式: HTTP GET

必需参数

参数说明示例
client调用方标识(13 位数字)1614133550001
key搜索关键词手机
charset编码utf8
urlencode返回编码yes
client_type客户端类型pcapp

可选参数

参数说明示例
expression_key组 idgroupids,,131241(可选,不传返回全部)
page页码1
pagesize每页数量20
filt_type过滤条件redisstore,1(有货)
scene场景 id0(主搜)

场景 ID 对照

  • 0 - 主搜关键词
  • 1 - 优惠券搜索默认跳转
  • 5 - 类目列表页
  • 9 - 店铺内全部商品
  • 10 - 店铺内关键词

编码注意事项

  • 中文参数需要用 UTF-8 编码后再 URL encode
  • 空格必须 encode 为 %20,不能用 +
  • 逗号 , 需要 encode 为 %2C

使用方法

基本搜索

jd-search "断路器"

指定页码和数量

jd-search "断路器" --page 2 --pagesize 50

按类目搜索

jd-search --catid 14081

带价格过滤

jd-search "断路器" --price 100-500

输出格式

jd-search "断路器" --format table    # 表格格式(默认)
jd-search "断路器" --format json     # JSON 格式
jd-search "断路器" --format csv      # CSV 格式

显示类目信息

jd-search "断路器" --with-category

返回字段

字段说明
wareid商品 ID
item_sku_idSKU ID
warename商品名称
brand品牌
dredisprice价格
totalsales销量
cid1/cid2/catid类目 ID
cid1name/cid2name/catname类目名称

类目层级

商品可能分布在多个类目下,常见类目路径:

家装建材 / 电工电料 / 断路器
工业品 / 中低压配电 / 断路器

示例输出

SKUID           商品名称                                               品牌                           价格      类目路径                                    
100005261983    正泰 (CHNT) 空气开关 家用小型断路器 空开 NBE7 2P 32A               正泰                   ¥   39.84  家装建材 / 电工电料 / 断路器                       
100005259429    正泰 (CHNT) 空气开关 家用小型断路器 空开 NBE7 2P 63A               正泰                   ¥   42.47  家装建材 / 电工电料 / 断路器                       

注意事项

  1. 接口为内网服务,需在京东内网环境调用
  2. 默认 expression_key 不传,返回全部商品
  3. 中文关键词自动进行 UTF-8 URL 编码
  4. 响应时间约 15-20ms

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…