online-shopping-discount

在有购物需求的情况下，提供查找优惠商品信息、生成优惠建议和优惠链接的能力。支持商品搜索、价格比较、优惠推荐和链接生成。

Before installing or invoking this skill, consider the following: - The scripts contact a custom remote API (default: https://online-shopping-discount.io.mlj130.com). If you don't trust that domain, do not run the scripts. Prefer skills that use official, documented APIs or well-known providers. - register.sh attempts to read device identifiers (macOS IOPlatformUUID, /sys/class/dmi/id/product_uuid, /etc/machine-id, Windows CIM UUID). These hardware IDs may be sent to the remote service as the username. If you are uncomfortable with exposing hardware identifiers, do not run register.sh or override the username with --username, or set SHOPPING_API_ENDPOINT to a proxy you control for inspection. - The scripts cache credentials locally in scripts/.credential_cache (mode 600). Even though permissions are restricted, the cached credential will persist across sessions and may be automatically refreshed, causing subsequent network calls. Remove or inspect the cache if you stop using the skill. - If you want to test safely: run the scripts in an isolated environment (throwaway VM or container), or set SHOPPING_API_ENDPOINT to a local/controlled endpoint to observe what data is transmitted before using on a real machine. - If you need similar functionality but want lower risk, prefer tools that call official public APIs (with documented client keys you control) or require explicit, user-provided credentials rather than auto-registering with a third‑party service. If you want, I can list the exact lines that read device identifiers and the default endpoints the scripts use so you can review them or create safe overrides.

Type: OpenClaw Skill Name: online-shopping-discount Version: 1.0.2 The skill bundle is classified as suspicious primarily due to the behavior of `scripts/register.sh`, which performs hardware fingerprinting by collecting unique system identifiers (macOS IOPlatformUUID, Linux product_uuid/machine-id, and Windows Win32_ComputerSystemProduct UUID) and sending them to a remote endpoint (online-shopping-discount.io.mlj130.com). While this behavior is disclosed in the documentation as a registration mechanism, collecting persistent hardware-level identifiers is excessive for a shopping discount tool and poses a privacy risk. The remaining scripts for searching and link generation appear to follow their stated purpose without obvious malicious logic.