Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

uniqlo-price-watch

v1.0.0

跟踪 UNIQLO 网站(uniqlo.cn)上的产品价格,将用户关注的商品持久化存储在你的工作目录下 uniqlo/uniqlo-price-watch.csv 中,如果文件缺失则自动创建,并在回答用户前将当前官方产品页面价格与保存的基准价格进行比较。

0· 105·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yjy233/uniqlo-price-watch.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "uniqlo-price-watch" (yjy233/uniqlo-price-watch) from ClawHub.
Skill page: https://clawhub.ai/yjy233/uniqlo-price-watch
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install uniqlo-price-watch

ClawHub CLI

Package manager switcher

npx clawhub@latest install uniqlo-price-watch
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (price watcher for uniqlo.cn) matches included code and instructions: a local CSV is maintained and a scraper is provided. However the skill runtime expects a FireCrawl API key and will call a FireCrawl scrape endpoint; the registry metadata declares no required env vars/credentials, so an important runtime dependency (FIRECRAWL_API_KEY) is undeclared.
!
Instruction Scope
SKILL.md instructs the agent to run the bundled script or use a browser tool to fetch product pages and to persist entries to uniqlo/uniqlo-price-watch.csv. The scraper path will POST the target URL to a third‑party service (api.firecrawl.dev) and return page markdown. Transmitting the target URL/page content to an external API is within the scraping purpose but is a data‑exfiltration surface the user should be aware of; SKILL.md does mention FIRECRAWL_API_KEY but does not flag the privacy/third‑party aspect prominently.
Install Mechanism
Instruction-only skill with one included script file. There is no download/install from remote hosts and no package installs — minimal risk from install mechanism.
!
Credentials
The script requires an API key (FIRECRAWL_API_KEY or alias FIRECRAWL-API-KEY) and optionally FIRECRAWL_API_URL and FIRECRAWL_TIMEOUT_MS, but the skill metadata lists no required env vars or primary credential. Asking for or reading an API key is reasonable for using a paid scraping service, but the undeclared credential is an inconsistency and giving an API key to the skill (or storing it in environment) grants a third‑party service access to the URLs/pages you query.
Persistence & Privilege
The skill writes a persistent CSV file into the agent's working directory (uniqlo/uniqlo-price-watch.csv). always is false and the skill does not request elevated platform privileges. Persistent local storage is expected for a watcher but users should know data will be stored on disk.
What to consider before installing
This skill appears to implement a legit Uniqlo price-watcher, but note two important issues before installing: - The bundled scraper posts your target URL (and effectively page content) to a third‑party API at api.firecrawl.dev and requires a FireCrawl API key. The registry metadata did not declare this required env var, so the skill may fail unless you provide a key or the agent asks you to paste one. Only provide an API key if you trust FireCrawl and understand their privacy/usage policy. - The skill will create and update a local CSV file at uniqlo/uniqlo-price-watch.csv in the agent working directory. If you care about sensitive info in that file, inspect or relocate it. Recommendations: - If you prefer not to send URLs/page content to an external service, refuse to provide a FIRECRAWL_API_KEY and use the browser scraping fallback described in SKILL.md (or ask the maintainer to remove the remote API usage). - Verify the trustworthiness and terms of api.firecrawl.dev before supplying keys. If you must supply a key, create a limited/low‑privilege key or use an account dedicated to this purpose. - Ask the skill author/registry to update metadata to declare FIRECRAWL_API_KEY as a required env var and to clearly document that page content is sent to FireCrawl.
firecrawl-scrape.mjs:60
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97akxbf40hjan30etm03egknx83ccn1
105downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

UNIQLO 价格监控

当用户想要跟踪一个或多个 UNIQLO 产品、保存之前的价格,或询问关注的商品是否降价时,使用此技能。

用户追踪目标记录

当用户想要追踪一个项目时应当 把用户的 想要的商品记录到 uniqlo/uniqlo-price-watch.csv ,在用户表示 某某商品买到后,删除对应商品。

每次用户提供衣服时候,必须让用户确认 具体页面 https://www.uniqlo.cn/search.html?description=484663&searchType=1 且提供图片给用户,注意url不要记录商详页,而应该是搜索结果页

uniqlo/uniqlo-price-watch.csv 格式

格式如下

商品名称,url,当前价格(rmb),上次价格(rmb),初始价格(rmb),更新时间 比如: 男装/男女同款 UT PEANUTS印花T恤/短袖T恤 485053,https://www.uniqlo.cn/search.html?description=484663&searchType=1,99,99,99,2026-3-22-10:52

如何获取商品价格

在用户添加监控商品时候,应当全部走 “获取商品价格的步骤-浏览器方案”。在后续监控任务中,在用户提供可用 fireCrawl API-KEY 的情况下(可以问用户要,或者读取环境变量 FIRECRAWL_API_KEY,兼容 FIRECRAWL-API-KEY),应当先使用 “获取商品价格的步骤-爬虫方案”,使用 “获取商品价格的步骤-浏览器方案” 兜底。

获取商品价格的步骤-爬虫方案 [] 直接运行脚本,不要让大模型总结页面:

node .skills/uniqlo-price-watch/firecrawl-scrape.mjs \
  "https://www.uniqlo.cn/search.html?description=484663&searchType=1"

[] 脚本输出必须只保留这两个字段:

{
  "markdown": "...",
  "url": "https://www.uniqlo.cn/search.html?description=484663&searchType=1"
}

[] 从 markdown 中提取商品名称和价格;如果脚本失败,再使用浏览器方案兜底

获取商品价格的步骤-浏览器方案 [] 使用browser工具,访问优衣库的搜索页面: https://www.uniqlo.cn/search.html [] 输入用户描述,选择优衣库搜索结果第一个商品 [] 点击进入商品页,拿到当前价格,并截图 [] 询问用户商品选择是否正确,如果正确更新到 uniqlo/uniqlo-price-watch.csv;如果错误回到第一步

Comments

Loading comments...