← Back to Skills Marketplace
rmbell09-lang

Lucky Gumroad Automation

by rmbell09-lang · GitHub ↗ · v1.0.1 · MIT-0
cross-platform ⚠ suspicious
110
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install lucky-gumroad
Description
Gumroad store automation — product creation, uploads, profile editing, data pulls. Use when any task involves Gumroad (creating products, managing listings,...
README (SKILL.md)

Gumroad Automation Skill

Authentication

Session is pre-authenticated. Never log in manually. Always reuse the saved Chrome profile.

Chrome Profile

Path: /home/openclaw/gumroad-profile

Rules (non-negotiable):

  • Always use --user-data-dir=/home/openclaw/gumroad-profile
  • Never clear cookies
  • Never use incognito/guest mode
  • Never run as root

Quick Session Test

timeout 20 google-chrome \
  --user-data-dir=/home/openclaw/gumroad-profile \
  --headless=new --no-sandbox --disable-gpu \
  --disable-dev-shm-usage \
  --dump-dom https://gumroad.com/dashboard \
  > /tmp/gumroad-test.html 2>/dev/null

grep -E "Dashboard/Index|logged_in_user|current_seller" /tmp/gumroad-test.html | head
  • If grep returns lines → session valid ✅
  • If URL is /login?next=%2Fdashboard → session expired ❌ (tell Ray)

Headless Chrome Launch (for automation)

google-chrome \
  --user-data-dir=/home/openclaw/gumroad-profile \
  --headless=new \
  --no-sandbox \
  --disable-gpu \
  --disable-dev-shm-usage \
  --remote-debugging-port=9222 \
  "https://gumroad.com/dashboard" &

Puppeteer / Playwright

// Puppeteer
const browser = await puppeteer.launch({
  headless: 'new',
  userDataDir: '/home/openclaw/gumroad-profile',
  args: ['--no-sandbox', '--disable-gpu', '--disable-dev-shm-usage']
});

// Playwright
const context = await chromium.launchPersistentContext('/home/openclaw/gumroad-profile', {
  headless: true,
  args: ['--no-sandbox', '--disable-gpu', '--disable-dev-shm-usage']
});

Account Info

  • Seller: qcautonomous
  • Display name: RayChod
  • Subdomain: qcautonomous.gumroad.com
  • User ID: 3256469230239

Important

  • If session ever expires, tell Ray — don't try to log in
  • Kill any leftover Chrome before launching: pkill -f "chrome.*gumroad-profile" 2>/dev/null
  • Always wait 2 seconds after kill before relaunching
Usage Guidance
This skill asks the agent to reuse a pre-authenticated Chrome profile stored at /home/openclaw/gumroad-profile but the manifest lists no required config path or credentials — that mismatch is the main red flag. Before installing or running: 1) Ask the skill author to explicitly declare and justify the required config path and any sensitive artifacts; prefer an API-based auth (Gumroad API token) rather than reusing a browser profile. 2) If you must run it, do so in an isolated VM/container with a dedicated Chrome profile created just for automation (do not reuse a personal system profile). 3) Inspect the profile directory to understand what it contains (cookies, localStorage, saved passwords) and limit its filesystem permissions. 4) Block/monitor network egress from the runtime environment and review logs for unexpected outbound connections. 5) Require the author remove or explain 'Never log in manually' and the instruction to always reuse the profile, and provide a fallback/auth-refresh mechanism that does not rely on opaque human instruction. If the author cannot justify the undeclared filesystem access, do not grant the skill access to your system profile.
Capability Assessment
Purpose & Capability
The skill's stated purpose (Gumroad automation) legitimately requires authenticated sessions, and reusing a Chrome profile can achieve that. However, the skill manifest declares no required config paths or credentials while the SKILL.md mandates use of a specific local profile path (/home/openclaw/gumroad-profile). That contradiction (an undeclared but required sensitive resource) is incoherent and should have been declared explicitly.
Instruction Scope
The SKILL.md instructs the agent to: reuse a local Chrome user-data directory, never clear cookies, run headless Chrome with remote debugging, dump DOM to /tmp, pkill Chrome processes, and never log in manually. These are system-level operations and direct access to a local browser profile (cookies, localStorage, tokens). The instructions do not declare or justify this sensitive filesystem access, and include social-engineering-like guidance ('Never log in manually' / 'tell Ray'), which broadens the operational scope beyond a simple API integration.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That minimizes risk from arbitrary installation artifacts or remote downloads.
Credentials
No environment variables, credentials, or config paths are declared in the registry metadata, yet the runtime instructions require direct access to a Chrome profile directory that effectively contains credentials (session cookies, auth tokens). Requesting access to that profile is equivalent to requesting sensitive credentials and should be explicitly declared and justified. The presence of hard-coded account identifiers (seller name, user id, subdomain) ties the profile to a specific account and increases risk if the profile is misused or exfiltrated.
Persistence & Privilege
The skill is not marked 'always: true' and is user-invocable (normal). However, because the agent is allowed to invoke skills autonomously by default, the combination of autonomous invocation with undeclared access to a persistent browser profile increases the potential blast radius. The skill also instructs the agent to kill and relaunch Chrome processes, which affects system state.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install lucky-gumroad
  3. After installation, invoke the skill by name or use /lucky-gumroad
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
Version 1.0.1 of lucky-gumroad - No code or documentation changes detected in this release. - All usage instructions, authentication steps, and session handling guidelines remain unchanged.
v1.0.0
Initial release of Gumroad store automation skill. - Enables automation of Gumroad tasks such as product creation, uploads, profile editing, and data retrieval. - Requires use of a pre-authenticated Chrome profile at `/home/openclaw/gumroad-profile`; manual login is never permitted. - Provides clear instructions for session validation and automated browser setup using headless Chrome. - Includes best practices for using Puppeteer or Playwright with the saved session. - Outlines procedures for handling expired sessions and safe browser relaunch.
Metadata
Slug lucky-gumroad
Version 1.0.1
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 2
Frequently Asked Questions

What is Lucky Gumroad Automation?

Gumroad store automation — product creation, uploads, profile editing, data pulls. Use when any task involves Gumroad (creating products, managing listings,... It is an AI Agent Skill for Claude Code / OpenClaw, with 110 downloads so far.

How do I install Lucky Gumroad Automation?

Run "/install lucky-gumroad" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Lucky Gumroad Automation free?

Yes, Lucky Gumroad Automation is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Lucky Gumroad Automation support?

Lucky Gumroad Automation is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Lucky Gumroad Automation?

It is built and maintained by rmbell09-lang (@rmbell09-lang); the current version is v1.0.1.

💬 Comments