test-publish

自动将商品从跨睿优质货盘铺货到Ozon电商平台。

Do not install or run this skill in a production environment until the author clarifies and fixes several issues: (1) Confirm the real target — the code visits http://139.9.192.16:9089/ (an IP) instead of Ozon's domain; explain why. (2) Declare and remove hard-coded credentials or replace them with required environment variables and document how to obtain credentials. (3) Add an install spec or clearly document the requirement to have Playwright and browser runtimes installed; otherwise the script won't run. (4) Fix small bugs / mismatches (script prints a different screenshot filename than it saves). (5) If you must run it for testing, do so in an isolated environment (sandbox/VM) and use test accounts; inspect network traffic to ensure no unexpected exfiltration. Ask the publisher for a corrected SKILL.md that documents endpoints, dependencies, and credential handling before trusting this skill.

Type: OpenClaw Skill Name: test-publish Version: 1.0.2 The skill bundle contains a Python script (scripts/auto_distribution.py) that uses hardcoded credentials (test/123456) and targets a raw IP address (http://139.9.192.16:9089/) over unencrypted HTTP. While these are significant security vulnerabilities and poor practices, they appear to be part of a test or demo environment rather than intentional malware. There is also a minor discrepancy between the script name referenced in SKILL.md (auto_distribute.py) and the actual file provided (auto_distribution.py).