Youxinpai Reconciliation

高性能执行优信拍月初保证金对账前置流程，在星河任务页批量查找并触发相关数仓任务并汇报执行结果。用户提到优信拍、保证金对账、月初对账、推送 x 月保证金数据、跑对账任务时使用。

This skill will (a) open internal web pages (https://dp.58corp.com/...), (b) edit a local repository file at an absolute path (/Users/a58/Desktop/code/yxp_oms_web/src/.../scf.config), (c) change the service host to a specific IP, (d) run a unit test, and (e) later restore the original config. The package metadata did not declare these config-path or file-write requirements — that's an inconsistency. Before installing or running: 1) only use this in a trusted, non-production environment; back up the referenced repo/config and confirm the absolute path is correct for your machine; 2) inspect scripts/run_tasks.js fully to confirm it does only the DOM automation you expect and does not exfiltrate data or call external endpoints; 3) prefer to adapt SKILL.md to use relative or configurable paths (do not blindly follow the hard-coded /Users/a58 path); 4) ensure you have permission to run local tests and edit the config (and review the intended host change to 10.192.12.236); 5) if you cannot verify the author or code, do not grant this skill access to your local filesystem or internal sites. These inconsistencies and the file-modification steps are why I classify it as suspicious rather than benign.

Type: OpenClaw Skill Name: youxinpai-reconciliation Version: 1.0.2 The skill performs high-risk operations including modifying local Java source code and configuration files within a specific directory (/Users/a58/Desktop/code/yxp_oms_web) and executing local unit tests. While these actions are aligned with the stated purpose of automating a 'Youxinpai' reconciliation workflow on internal platforms (dp.58corp.com), the requirement to programmatically alter source code and run local tests constitutes a significant risk. There is no evidence of intentional malice or data exfiltration, but the broad local write/execute permissions and hardcoded private IP (10.192.12.236) warrant a cautious classification.