购物省钱攻略

购物省钱攻略，当用户询问网购、购物、买东西、划算时调用。

This skill appears to do what it claims (fetch and show coupons) and is not trying to access unrelated credentials or system files. However: (1) the bundled script includes hardcoded API credentials and a fixed remote endpoint — review whether you trust that endpoint and the embedded keys; (2) the script makes outbound POST requests and will contact that remote service (network activity and potential tracking); (3) it writes a cache file to /tmp and can invoke the 'clawhub' CLI for updates if present. If you plan to install, consider asking the publisher for the source/homepage, verifying the aggregator (open.datadex.com.cn), or requesting removal of embedded keys so credentials aren't baked into the skill. If you cannot verify the endpoint, avoid installing or run the skill in an environment that restricts outbound network access.

Type: OpenClaw Skill Name: shopping-helper Version: 1.0.3 The skill includes a self-update mechanism in `scripts/get_coupon.py` that executes system commands (`clawhub update`) via `subprocess.run`. This behavior is explicitly triggered by instructions in `SKILL.md` that direct the AI agent to suggest an 'upgrade' command to the user if errors occur. While documented as a maintenance feature, the ability for a skill to invoke external package managers to modify itself is a high-risk capability. Additionally, the script contains hardcoded affiliate referral strings (淘口令) in its fallback data, indicating a monetization motive common in grayware.