Zepto

Order groceries from Zepto in seconds. Just say what you need, get a payment link on WhatsApp, pay on your phone, done. Remembers your usual items. Works across India where Zepto delivers.

What to check before installing/using this skill: 1) WhatsApp sending: verify how payment links are sent. The SKILL.md claims WhatsApp will receive the link, but the repo lacks explicit WhatsApp-sending code — confirm your platform-level WhatsApp channel is configured and that the skill will not ask you to paste credentials or send messages via an untrusted third party. 2) Review scraping behavior: the skill visits your Zepto account order pages and scrapes DOM text. Inspect zepto-parser.js and the scraping steps to ensure only item names and counts are saved. If you have sensitive address or order metadata in those pages, test scraping in a disposable account or profile first. 3) Check local storage: order-history.json is written to your skill directory (~/.openclaw/skills/zepto/). Inspect the file after running and delete it if you don't want a local shopping history. Make sure it doesn't accidentally include addresses/phone numbers. 4) Limit autonomous actions: if you are uncomfortable with the skill acting without an explicit prompt, disable autonomous invocation for this skill in your agent settings (or run it only on-demand). The code contains an agent component capable of performing browser actions. 5) Test in a safe environment: run initial tests with a throwaway Zepto account or in a separate browser profile to observe behavior, and watch for unexpected network activity or captured data. 6) Code review: if you will rely on this skill, have someone with Node/browser-automation familiarity quickly review zepto-agent.js, zepto-ops.js, and zepto-parser.js to validate that only the intended fields are captured and that no hidden network endpoints or credentials are used. If you can't verify the WhatsApp flow or are unable to confirm the scraper only captures item names, treat the skill with caution.

Type: OpenClaw Skill Name: zepto Version: 1.0.6 The OpenClaw skill bundle is classified as benign. Its primary function is to automate grocery ordering on Zepto.com using browser automation, which is a powerful but necessary capability for its stated purpose. The skill is transparent about its actions, explicitly disclaims malicious behaviors (e.g., no automatic payments, no external data transmission beyond Zepto.com and WhatsApp, no credential storage, no persistent background jobs), and the code aligns with these statements. Instructions in `SKILL.md` guide the AI agent to follow safe operational procedures, such as always confirming the address and checking the cart, rather than attempting prompt injection for malicious ends. Local file storage for `order-history.json` is disclosed and used for a legitimate 'usuals' feature. While browser JavaScript execution (`browser act request='{"fn":"..."}'`) is a high-risk capability, the provided JavaScript is confined to Zepto.com DOM manipulation for the skill's intended functionality.