← Back to Skills Marketplace
108
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install selection-agent
Description
全渠道选品 Agent — 关键词调研、SEO分析、竞品分析、TrendPlus数据。触发词：选品、关键词调研、SEO分析、竞品分析、keyword research、competitor analysis。执行前必须读取 AGENT_CONFIG.md。
Usage Guidance
Do not enable this skill without verification. The SKILL.md instructs the agent to read /tmp/powerful-trendplus/AGENT_CONFIG.md, source .env.local, and run a local Python script — actions that can expose local secrets or execute arbitrary code. Before installing, ask the publisher to: (1) provide a trusted source URL and SHA256 for scripts; (2) update metadata to list all required env vars and explain why each is needed; (3) publish the AGENT_CONFIG.md and run_full_research.py for review. If you must test, do so in an isolated sandbox or VM, and avoid granting production credentials (move keys to a test account). If you do install, inspect /tmp/powerful-trendplus and .env.local contents and remove or redact any secrets you don't want the agent to access.
Capability Analysis
Type: OpenClaw Skill
Name: selection-agent
Version: 1.0.0
The skill bundle contains highly risky instructions in SKILL.md that direct the AI agent to execute a Python script from a temporary directory (/tmp/powerful-trendplus/scripts/run_full_research.py) and source local environment variables (.env.local). It explicitly mentions that sensitive tokens and API keys (Semrush, FB_ADS_TOKEN, NOTION_API_KEY, GEMINI_API_KEY) are stored in these local files. While these behaviors facilitate arbitrary code execution and potential credential access, the lack of the actual script payload or explicit exfiltration logic makes it impossible to confirm malicious intent versus extremely poor security practices for a research tool.
Capability Assessment
Purpose & Capability
The declared purpose (keyword/SEO/competitor research) reasonably explains needing Semrush, FB Ads, Sheets, and a DB. However the skill metadata declares no required env vars or credentials while SKILL.md explicitly lists multiple sensitive keys and external dependencies. That mismatch is incoherent: either the metadata is incomplete or the skill is attempting to access secrets it didn't declare.
Instruction Scope
Runtime instructions demand reading /tmp/powerful-trendplus/AGENT_CONFIG.md, sourcing .env.local, and running python3 scripts/run_full_research.py — i.e., reading arbitrary local files and executing a local script. The instructions also reference multiple credential locations (~/.bashrc, system env, .env.local) and external data sources (sitemaps, CMS API, Notion DB). This goes beyond a simple API-integration description and grants broad access to host files and secrets.
Install Mechanism
Instruction-only skill with no install spec or code files. That lowers installer risk because nothing is automatically downloaded or written by an installer. The primary risk comes from runtime file access and execution, not an install step.
Credentials
SKILL.md expects multiple sensitive credentials (SEMRUSH_API_KEY, FB_ADS_TOKEN, NOTION_API_KEY, GEMINI_API_KEY, Google OAuth, MySQL creds) but the skill metadata lists none. It also suggests those secrets live in diverse locations (.env.local, system env, ~/.bashrc). Requesting many kinds of credentials across different services is disproportionate unless explicitly declared and justified in metadata.
Persistence & Privilege
The skill is not 'always: true', but its instructions cause the agent to execute an arbitrary local Python script. If the agent is allowed to invoke the skill autonomously, that script could perform any actions the agent's runtime permits (network calls, file reads/writes, secret exfiltration). This is a meaningful runtime privilege even absent installer persistence.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install selection-agent - After installation, invoke the skill by name or use
/selection-agent - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of selection-agent skill.
- Provides automated product research across channels: keyword research, SEO analysis, competitor analysis, and TrendPlus data.
- Activates on trigger words (中文/English), e.g., 选品, 关键词调研, keyword research, competitor analysis, etc.
- Structured output format with required fields like keyword, difficulty, volume, dedup source, and priority.
- Reads all configuration from AGENT_CONFIG.md before execution; includes fixed environment variables and competitor list.
- Integrates with Semrush, Facebook Ads, Notion, and other data sources.
- Lists common errors and troubleshooting steps for smooth usage.
- Project repository link and setup instructions included.
Metadata
Frequently Asked Questions
What is Selection Agent?
全渠道选品 Agent — 关键词调研、SEO分析、竞品分析、TrendPlus数据。触发词：选品、关键词调研、SEO分析、竞品分析、keyword research、competitor analysis。执行前必须读取 AGENT_CONFIG.md。 It is an AI Agent Skill for Claude Code / OpenClaw, with 108 downloads so far.
How do I install Selection Agent?
Run "/install selection-agent" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Selection Agent free?
Yes, Selection Agent is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Selection Agent support?
Selection Agent is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Selection Agent?
It is built and maintained by lygjoey (@lygjoey); the current version is v1.0.0.
More Skills