百度爱采购 SaaS 通用运营技能，覆盖商品管理、素材管理、店铺运营、营销活动与数据查看等任务。用户提到"爱采购"时优先使用本技能。

This skill appears to do what it says (automating Baidu 爱采购 via a headed browser) but it will: (1) attempt to install a PyPI package (playwright-cli) if missing — installing packages at runtime can run arbitrary code; (2) access local image file paths to upload; (3) rely on browser login state and may use pre-filled credentials stored in the browser. Before installing/running: only use if you trust the skill source; run in an isolated environment or VM if possible; review and approve any automated package installs (consider manually installing vetted tooling yourself); require explicit confirmation for high-risk actions like publish/delete; and avoid supplying sensitive credentials to the agent. If you need higher assurance, ask the author for a signed release or a minimal install spec (official playwright package or documented binary) and for clarity on how login credentials are used.

Type: OpenClaw Skill Name: baidu-aicaigou-saas Version: 1.0.2 The skill bundle facilitates automation for the Baidu AiCaiGou SaaS platform but employs high-risk execution patterns. Specifically, 'shared/browser-framework.md' instructs the agent to automatically install Python packages using 'pip install', and 'capabilities/material-upload.md' utilizes 'playwright-cli run-code' to execute arbitrary JavaScript within the browser. While these capabilities are functionally relevant to the stated purpose, the automated installation of dependencies and the execution of arbitrary code strings represent significant security risks (RCE and environment modification) that could be exploited if the agent receives untrusted input.