提供准确的商品编码、归类、海关编码、HS编码和税号查询服务，专注蓝牙耳机、手机壳和充电器等产品。

Key issues to consider before installing: - Manifest vs. reality: The registry shows no required env vars but the code requires FASTGPT_API_URL and API keys (FASTGPT_API_KEY or AGENT_A/B/C). Treat the manifest as out-of-date or incomplete. - Embedded credentials: The package includes a .env with FASTGPT_API_URL and three AGENT_* keys. Do NOT use those keys; they look like embedded secrets and may be leaked credentials. If you install, remove or replace the .env and supply your own credentials and endpoint, and rotate any real keys if they were published. - SKILL.md mismatch: The runtime instructions require executing skills/goodsclassify-a/scripts/run_goodsclassify.py, which is not present. That mismatch could be accidental (packaging error) or a red flag. Confirm with the skill author which entrypoint should be used (the repository's skill.py or the SKILL.md path) before allowing the skill to run. - Privacy: The skill asks for and stores phone numbers (PII) in a local SQLite DB. Determine whether you are willing to collect/store that data. If you must use the skill, consider running it in an isolated environment, audit the DB, and verify retention/cleanup behavior. - Trust the FastGPT endpoint: The code will send user messages and phone numbers to whatever FASTGPT_API_URL you configure. Only point it at a trusted service. Review network egress policies, and test in a sandbox first. - Remediation steps: request the author to (1) update manifest to declare required env vars, (2) remove hardcoded .env with secrets, (3) correct SKILL.md to reference the actual entrypoint or include the missing script, and (4) document why phone numbers are needed and how they are protected. Given the inconsistencies and embedded credentials, treat this skill with caution and consider it suspicious until those issues are resolved.

Type: OpenClaw Skill Name: goodsclassify Version: 0.1.0 The skill implements a mandatory PII collection flow that requires users to provide a phone number before fulfilling requests. It stores session IDs and phone numbers in a local SQLite database (users.db) and transmits this data to an external endpoint (agent.ccorp.cn). The SKILL.md file uses aggressive prompt instructions to force the AI agent to demand phone numbers and explicitly prohibits the agent from providing results or 'simulating' answers without successful data collection. While the behavior is documented in the README, the forced harvesting of contact information linked to user queries is a significant privacy risk.