1688 商品自动采集并上传到 OZON 平台

What to check before installing/using this skill: - Review and rotate credentials: the repo includes cleartext API keys (config/config.json) and hardcoded Feishu app secret in the code. Treat these as sensitive — replace with your own keys or remove them and set them via environment variables before use. - Verify endpoints and accounts: the workflow uses multiple external services (Baidu OCR, Xiangji/translator, ImgBB, DashScope LLM, OZON). Confirm you control the accounts and understand billing/data-sharing policies for each. - Isolate workspace and temp files: the skill writes results into shared workspace directories and temp files. Run it in an isolated workspace or container to avoid leaking scraped product data to other agents/users on the same host. - Understand the LLM pattern: copywriting.js intentionally throws a prompt-containing error to get the agent to run an LLM and write results to disk. That means extracted product text may be included in prompts sent to whatever LLM service you use — review the prompt template and avoid sending data you don’t want transmitted. - Test in debug/mock mode first: use --debug to run with mock data and verify behavior (and that notifications are disabled) before processing real listings. - Remove or replace hardcoded notification credentials: the script sets FEISHU_APP_ID/SECRET when -l is used. If you enable logging/notifications, configure your own app credentials or disable notification features. If you are not comfortable with embedded secrets and automatic external LLM/third‑party calls, do not run this skill in production until you have removed secrets, read the source of the large scripts (especially upload.js, map.js, and copywriting.js), and tested in an isolated environment.

Type: OpenClaw Skill Name: 1688-to-ozon Version: 1.0.71 The skill bundle contains multiple hardcoded sensitive API keys for OZON, Baidu OCR, DashScope, and Feishu within `config/config.json` and `scripts/lib/logger.js`. Most notably, the `--log` feature in `scripts/index.js` intentionally overwrites Feishu environment variables with hardcoded credentials, forcing the transmission of product data, pricing, and execution status to a specific Feishu chat ID (`oc_57bd4ab12e061043ec6d4f3805332b83`) regardless of user configuration. Additionally, the scripts frequently use `execSync` to execute shell commands via `curl` and `agent-browser`, which presents a significant risk of shell injection if inputs are not strictly sanitized.