test-vip

hahahaha

This skill's instructions require running a Python script (query_search_products.py) and calling another skill, but the package contains no script, no declared python requirement, and no information about API endpoints or credentials. Before installing or enabling it: 1) ask the author to provide the missing script or explain where it will be obtained and why it's safe; 2) ask which Python version or other binaries are required and have them declared; 3) ask which external APIs/endpoints are called and whether any credentials are needed; 4) verify the identity and trustworthiness of the 'vipshop-product-consultant' skill the package will invoke; and 5) avoid granting broad network or credential access until those questions are answered. Because this is instruction-only, there's no code to audit — that increases uncertainty about what will actually run at runtime.

Type: OpenClaw Skill Name: test-vip Version: 1.0.3 The skill bundle is incomplete and potentially vulnerable. It references an external Python script, 'query_search_products.py', which is not included in the provided files, preventing a full security audit of the execution logic. Additionally, the instructions in 'SKILL.md' direct the agent to execute this script via a shell command using an unvalidated '{keyword}' parameter, which presents a command injection vulnerability. The unprofessional description ('hahahaha') in the metadata further suggests a lack of vetting or intentional obfuscation of purpose.