商业捡漏预警虾

What to consider before installing or running this skill: - Functional gaps: The included monitor.py is a demo that returns simulated results. The SKILL.md says it will push to Feishu by default, but no Feishu webhook/token is declared — confirm how notifications are actually delivered before assuming automatic pushes. - Credentials & cookies: Real scraping of platforms like 闲鱼 and 链家 generally requires login state (cookies or username/password) or browser automation (Selenium). The skill does not declare or request these secrets, so you will need to provide and manage them yourself. Treat those credentials as sensitive and avoid storing them in plaintext or broadly accessible locations. - Dependencies: The script references using Selenium and browser simulation in comments; there is no install step or dependency list. Installing drivers, browsers, and Python packages will be a manual step. Run these in a controlled environment (container or VM) to limit blast radius. - Data storage: The skill stores seen IDs and alerts under ~/.openclaw/workspace/deal-hunter-data. Confirm you’re comfortable with the skill writing files there and set appropriate file permissions if needed. - Legal/ToS and rate limits: Scraping some platforms can violate terms of service or lead to IP blocking. The references include rate-limit and anti-bot strategies; follow them and consider using official APIs where available. - Security posture: Because the demo indicates you must replace simulated fetchers with real scraping code, carefully review any custom scraping implementation for hidden network calls or exfiltration. If you want a deeper review, provide the full, non-truncated monitor.py (the provided file was partially truncated in the package listing) and any code you plan to add for real scraping or notification delivery. - Recommended safe steps: run the skill in a sandbox or container, limit network access for the container to only the target platforms and notification endpoint, provide credentials via a secrets manager or environment variables with restricted scope, and test on non-production accounts first. Confidence note: medium — the assessment is limited because parts of monitor.py were truncated in the package listing and the skill delegates important behavior (login, push notifications) to either other skills or unimplemented code; seeing the full code that performs notification or real scraping would raise confidence and could change the verdict.