唯品会商品搜索

This skill appears to implement VIP.com search and uses local login tokens to make authenticated requests — that is coherent with its purpose. Things to check before installing: (1) SKILL.md forces the agent to auto-detect login state and automatically install+invoke the vipshop-user-login skill and run its login script without explicit user confirmation — decide whether you want an agent that will install and run other skills and block waiting for a QR-scan. (2) The documentation repeatedly states the skill must return 20 items, but the search.py implementation uses BATCH_SIZE = 10 — expect behavior mismatch (you may get 10 items). (3) The skill reads ~/.vipshop-user-login/tokens.json (contains PASSPORT_ACCESS_TOKEN) and will write device files under ~/.vipshop-user-login; treat that token file as sensitive. Only proceed if you trust the vipshop-user-login skill and are comfortable with the agent accessing those files. (4) exchange_link_builder contains a hardcoded secret used to sign exchange links — confirm you trust that mechanism and understand that generated links embed the token (base64) as dt parameter (clicking/forwarding such links could reveal auth data). If you want to reduce risk: require explicit user consent before auto-installing/invoking other skills, disable autonomous invocation for this skill, or review/replace the login flow so the user explicitly performs the login step.