XiaomiYe

人人商城龙虾助手 - 人人商城数据查询与订单管理工具。 当用户提到以下意图时使用此技能： 「查待办事项」「查运营数据」「查商品信息」「查会员信息」 「查订单」「管理订单」「查优惠券」「设置满额包邮」 「配置商城API」「验证API连通性」 支持：待办事项查询、运营数据统计、商品/会员/订单全维度查询、优惠券管理、...

What to check before installing: - Confirm source/trust: verify the skill homepage and the publisher; the package metadata contains conflicting ownerId/slug/version values which suggests packaging or distribution mistakes. - Confirm which environment values the platform will actually inject (RR_CLAW_API_KEY and RR_CLAW_BASE_URL are referenced in SKILL.md). Do not place high-privilege keys in world-readable files. - Ensure the platform enforces that HTTP requests are limited to the configured RR_CLAW_BASE_URL (the skill asserts this but you should verify network policy/logging on your platform). - Review the included scripts/request_client.py (it's small and simply wraps requests), and confirm there are no hidden endpoints — the client only uses Authorization header and standard GET/POST to base_url. - Treat destructive actions (close order, stop coupon, take product off-shelf, close free-shipping) as sensitive: confirm the skill will always ask for explicit user confirmation before calling those POST endpoints. - If you lack confidence in the publisher, request a corrected package with consistent metadata and an explicit manifest of required env vars before enabling the skill. If these checks are satisfied the skill appears coherent for its stated purpose; if the packaging/metadata discrepancies remain unexplained, avoid enabling it until clarified.

Type: OpenClaw Skill Name: syxx Version: 1.0.0 The skill bundle is a management tool for the Renren Mall (人人商城) platform, providing capabilities to query operational data, manage orders, and update product listings. The Python client in `scripts/request_client.py` is a standard wrapper for the platform's API, and the `SKILL.md` file includes explicit security constraints, such as requiring user confirmation for 'dangerous' operations (e.g., closing orders or stopping coupons) and protecting API credentials. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.