CEO小茂能力包

This package appears to implement the features it advertises, but its manifest is incomplete and there are a few implementation details you should verify before use: - Expect to provide SMTP credentials (MAIL_ACCOUNT / MAIL_CREDENTIAL), WhatsApp/Green API credentials (GREEN_API_URL, GREEN_API_INSTANCE_ID, GREEN_API_CREDENTIAL), and OneABC credentials (ONEABC_ACCESS_CREDENTIAL). Do not supply high-privilege or production credentials without testing in isolation. Consider using accounts with limited scope. - The scripts call an 'openclaw' CLI and use Selenium (Chrome / chromedriver). The manifest omitted these required binaries — install and test these separately before running auto_reply or get_google_maps_leads. - oneabc.js uses a default API host (https://api.oneabc.org) and the Python auto-reply has a default GREEN API host; confirm these endpoints are ones you trust. The code concatenates the 'Authorization' header name (evasion-style) — ask the author why that was done and prefer transparent header construction. - Google Maps scraping via selenium may violate Google’s terms of service in some contexts; review legal/ethics before scraping. - Run the skill in an isolated workspace or container, review the created files (.known_customers.json, .boss_notifications.json, logs) and the code yourself, and prefer creating test accounts to reduce exposure of primary credentials. If the publisher can update the registry metadata to declare required env vars and binaries and explain the header-concatenation and default endpoints, the incoherences would be resolved and risk lowered.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.