品氪 OpenApi 开放平台 Skill

品氪提供的OpenApi开放平台，支持门店、导购、会员、订单、退单、库存、商品、积分、储值、卡券、销售等全链路CRM/SCRM数据同步与管理。通过安全认证的API接口实现第三方系统与品氪平台的数据互通。

Before installing: (1) Verify the PK_API_URL value points to an official Pinkr endpoint (production vs dev) and that you trust that host. (2) Expect to provide a secret PK_APPKEY — confirm the registry-level metadata omission is just an error and not an attempt to hide credential use. (3) Review the included Python script yourself (it posts form data to the configured URL and writes results to a local 'output' folder); run it in an isolated environment if possible. (4) Avoid supplying unrelated credentials; the skill only needs one app key and an API base URL. (5) If you need higher assurance, ask the publisher for a canonical homepage/source or signed releases, or request the skill be repackaged so registry metadata matches the SKILL.md.

Type: OpenClaw Skill Name: pinkr-openapi-skill Version: 1.0.1 The skill provides a comprehensive interface for the Pinkr OpenAPI to manage CRM/SCRM data. However, it is classified as suspicious because both the documentation (SKILL.md) and the implementation (pinkr_openapi_skill.py) default to an insecure HTTP endpoint (http://dev.openapi.pinkr.com). This vulnerability allows for the interception of sensitive information, including the PK_APPKEY (used as the appid in requests) and customer data such as member details and order history. While the code logic appears aligned with its stated purpose and lacks evidence of intentional malice, the use of unencrypted transport for authentication tokens and PII is a significant security flaw.