Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
ecommerce-product-selector
v1.0.2电商平台爆款产品筛选分析 - 基于数据分析的智能选品工具，支持淘宝、京东、拼多多、抖音、亚马逊等平台
⭐ 0· 70·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims 'big data' analysis across many e‑commerce platforms (Taobao, JD, PDD, Douyin, Amazon, etc.) but the SKILL.md provides no integrations, APIs, data sources, or instructions for obtaining real‑time marketplace data. For a genuinely data‑driven product selector you would normally expect declared APIs, scraping instructions, or credentials for platform analytics — none are present, so the claimed capabilities are not substantiated.
Instruction Scope
The SKILL.md is an instruction‑only document that shows example queries and example output; it does not instruct the agent to read local files, access environment variables, install software, or call external endpoints. The runtime instructions themselves stay within the stated conversational/reporting scope.
Install Mechanism
No install spec and no code files are included (instruction‑only). This minimizes technical risk from installation actions, but also means the skill relies entirely on the model or external unspecified data sources.
Credentials
The skill declares no required environment variables or credentials (proportional), but that is inconsistent with its promises of cross‑platform market monitoring. Also, the SKILL.md contains developer payment information (USDC address and WeChat pay mention) — unrelated to runtime requirements and a potential fraud/transaction risk if users are asked to pay outside the official marketplace.
Persistence & Privilege
The skill does not request persistent or elevated privileges (always:false, no config paths, no installs). It behaves like a normal user‑invokable instruction‑only skill.
What to consider before installing
This skill is an instruction‑only assistant that promises data‑heavy analysis but provides no APIs, scraping logic, or data sources — expect generic or hallucinated answers unless the developer provides access to real data. Before installing or paying: 1) Ask the developer which data sources/APIs are used and request sample outputs tied to real timestamps; 2) Do not provide platform login credentials or private keys; 3) Prefer payments through the official marketplace rather than direct crypto/WeChat; 4) Test the skill with non‑sensitive queries and verify results against known market data; 5) If you need true real‑time analytics, require the developer to document integrations and any required credentials or third‑party services. If the developer cannot explain how live platform data is obtained, treat results as speculative.Like a lobster shell, security has layers — review code before you run it.
AIvk978kvnes4f63mp0z92bnb7gxd845y4bautomationvk978kvnes4f63mp0z92bnb7gxd845y4bchinesevk978kvnes4f63mp0z92bnb7gxd845y4becommercevk9789rvd9drh12fjr081gmsfy1845vsslatestvk978kvnes4f63mp0z92bnb7gxd845y4bprovk978kvnes4f63mp0z92bnb7gxd845y4bproductvk9789rvd9drh12fjr081gmsfy1845vssproductivityvk978kvnes4f63mp0z92bnb7gxd845y4bselectorvk9789rvd9drh12fjr081gmsfy1845vss
License
MIT-0
Free to use, modify, and redistribute. No attribution required.