← Back to Skills Marketplace
88
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install pdd-rebate
Description
返利宝统一技能。只按 3 个用户场景工作：S01 授权与教程、S02 链接返利、S03 商品搜索。用户说“返利”“教程”“详细教程”“提现教程”“提现10元”“确认提现”“我已授权”“账户余额”等走 S01；发送淘宝、京东、拼多多商品链接走 S02；表达想买什么商品时走 S03。S03 的职责是提取商品搜索信息，...
Usage Guidance
This skill appears to implement the claimed rebate flows, but exercise caution before installing or authorizing it: 1) The skill directs users to a custom domain (xiaomaxiangshenghuo.io.mlj130.com) for authorization and following a public account — verify this service and its privacy policy before completing any authorization. 2) The skill requires execution of included Node scripts and will call remote APIs (search/create rebate/withdraw) and persist a local machine code/openid — do not provide sensitive credentials or payment info unless you trust the operator. 3) The SKILL.md forces returning script output verbatim (including links), so the assistant will not add safety warnings; be careful clicking links returned by the skill. If you need higher assurance, ask the publisher for a homepage, source/organization identity, or run the skill in a sandboxed environment and inspect network calls (or review common.js to see exact backend URLs) before authorizing any account bindings.
Capability Analysis
Type: OpenClaw Skill
Name: pdd-rebate
Version: 1.0.1
The skill bundle implements a rebate assistant that uses system-level calls (spawnSync with curl) in 'scripts/common.js' to perform network requests and fetch external HTML. It collects and persists sensitive identifiers, including the OpenClaw deviceId (as a machine_code) and user openids, which are transmitted to a remote service (rebate-skill.io.mlj130.com) to facilitate product searches and financial withdrawals. While these capabilities are consistent with the stated purpose of a rebate tool, the combination of system-level execution, financial transaction handling, and strict 'Hard Constraints' in 'SKILL.md'—which forbid the AI agent from adding any context or explanations to tool outputs—presents a high-risk profile that could be used to mask unauthorized actions or exploit the underlying system if input sanitization is bypassed.
Capability Assessment
Purpose & Capability
Skill claims to be a unified rebate assistant (PDD/淘宝/京东) and the code implements link recognition, product search, lease/apply and withdraw flows that align with that purpose. Minor mismatch: registry name emphasizes 拼多多 but code supports tb/jd/pdd — not dangerous but worth noting.
Instruction Scope
SKILL.md enforces that script stdout must be returned verbatim and forbids adding any extra explanation. Scripts produce external URLs and user-facing auth/follow links; the combination prevents the assistant from adding safety/contextual warnings or sanitizing returned text. The runtime also requires executing scripts that may call remote APIs and return HTML/links directly to the user.
Install Mechanism
Registry lists 'no install spec' (instruction-only) but the bundle contains many runnable Node scripts and build instructions in SKILL.md. That mismatch is noteworthy: the skill will execute code shipped with the package rather than being purely instruction-only; there is no package install URL but local scripts will be executed.
Credentials
No declared environment variables or secrets, which is reasonable. However the code calls external rebate backend APIs (search, create rebate link, withdraw, etc.) and uses a custom domain (xiaomaxiangshenghuo.io.mlj130.com) for auth/follow/landing pages. The skill saves a local 'machine code' and openid binding — this stores user identifiers locally and exchanges them with the remote service. Users should verify the third-party domain before authorizing.
Persistence & Privilege
always:false. The skill persists local state (machine code, openid binding, pending auth requests) for its own flows but does not request system-wide privileges or modify other skills. That persistence is expected for an auth-flowed service, but combined with the enforced verbatim-return rule it increases risk of returning unvetted links.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install pdd-rebate - After installation, invoke the skill by name or use
/pdd-rebate - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
**提现流程和话术升级：本版本新增提现流程路由与话术，完善对提现场景（如“提现10元”“确认提现”）的识别与处理。**
v1.0.0
拼多多返利技能 v1.0.0
- 首发版本，覆盖京东、拼多多、淘宝三大平台的返利场景。
- 支持三大核心能力：商品链接返利、商品搜索返利、返利教程与账户查询。
- 明确按 S01（授权和教程）、S02（链接返利）、S03（商品搜索）三个用户场景路由处理用户请求。
- 所有重要脚本和接口调用输出，均以 md 格式原样返回用户。
- 强制执行统一入口和严格的消息处理约束，杜绝接口输出外的自定义话术。
- 全流程支持授权、返利链接生成、商品搜索和账户余额等操作。
Metadata
Frequently Asked Questions
What is 拼多多返利?
返利宝统一技能。只按 3 个用户场景工作：S01 授权与教程、S02 链接返利、S03 商品搜索。用户说“返利”“教程”“详细教程”“提现教程”“提现10元”“确认提现”“我已授权”“账户余额”等走 S01；发送淘宝、京东、拼多多商品链接走 S02；表达想买什么商品时走 S03。S03 的职责是提取商品搜索信息，... It is an AI Agent Skill for Claude Code / OpenClaw, with 88 downloads so far.
How do I install 拼多多返利?
Run "/install pdd-rebate" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is 拼多多返利 free?
Yes, 拼多多返利 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does 拼多多返利 support?
拼多多返利 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created 拼多多返利?
It is built and maintained by wuweizhen (@skyfile); the current version is v1.0.1.
More Skills