Taobao Merchant Ops

淘宝商家运营自动化客户使用说明。包含功能介绍、安装步骤、卡密激活方式、运行方法和购买信息。

This skill is largely coherent with its stated purpose, but it has some sensitive behaviors you should consider before installing: 1) License activation: the program POSTs your card key and a machine fingerprint to a remote license server. The default server is a raw IP (http://120.27.202.105:8000). If you don't trust that endpoint, do not enter card keys or use the tool until you verify the server's identity. You can override the server via TMO_LICENSE_SERVER, but only if you know a safe endpoint. 2) Browser login state: the RPA reuses and writes a storage_state file that contains authentication cookies—treat that file as highly sensitive (it can grant account access). 3) Bundled get-pip.py: the repo includes a huge pip bootstrap blob; while likely legitimate, bundling increases audit surface—inspect it if provenance matters. Recommended precautions: run the tool in an isolated VM or disposable container; review license_gate.py and confirm the activation endpoint before entering secrets; avoid reusing production account logins (use a test account) or delete saved storage state after use; inspect network activity (e.g., via a firewall) during first runs; contact the seller/source for a verifiable homepage or signed releases before trusting real credentials. If you want, I can point out the exact lines that perform remote activation, where files are written, and what data is sent.

Type: OpenClaw Skill Name: taobao-merchant-ops Version: 1.0.8 The skill bundle is a commercial RPA (Robotic Process Automation) tool designed for Taobao merchants to automate data collection and shop inspections. It uses Playwright for browser automation and openpyxl for Excel report parsing. While it includes a 'phone-home' licensing mechanism (scripts/license_gate.py) that sends a hardware fingerprint (SHA256 hash of hostname and MAC address) to a remote server (120.27.202.105) for activation, this behavior is transparently documented in SKILL.md and aligned with its commercial purpose. Sensitive session data (cookies) are stored locally in 'yingdao_storage_state.json' and are not exfiltrated. The code lacks indicators of malicious intent, such as unauthorized data theft, persistence mechanisms, or obfuscated payloads.