codropshiping-product-search

Searches for products on the Codrop shipping platform using a keyword.

This skill's behavior is coherent with its description — it POSTs {keyword} to a Codrop-like endpoint using the provided token — but there are a few things to check before using it with real credentials: - Provenance: there is no homepage or known source; verify the author and whether the endpoint (test-codrop.cargosoon.online) is the correct/trusted service you intend to query. - Secret handling: the script expects --token on the command line. CLI args can leak via process listings and may be saved in shell history. Prefer a version that reads the token from an environment variable or prompts interactively, and update metadata to declare the credential. - Test first: run with a dummy token to observe responses and ensure the endpoint behaves as expected. - TLS/endpoint trust: the script uses HTTPS but points to an unfamiliar host. Confirm the certificate and that you trust the service before sending real tokens. - If you need stronger assurance: ask the author for a package with declared required credentials (primaryEnv) and supply instructions for safer secret handling, or request a reputable source/homepage. Given the metadata mismatch and unknown host, proceed cautiously — this looks legitimate in function but has enough provenance and secret-handling issues to treat as suspicious until validated.

Type: OpenClaw Skill Name: codropshiping-product-search Version: 1.0.0 The skill is a straightforward implementation of a product search tool for the Codrop shipping platform. The script `scripts/product-search.js` uses the standard Node.js `https` module to send a keyword and authentication token to a specific API endpoint (test-codrop.cargosoon.online). There is no evidence of data exfiltration, malicious execution, or prompt injection; the code's behavior aligns perfectly with its documented purpose.