饿了么外卖推荐技能，根据用户饭点和口味偏好推荐附近外卖

This skill appears to do what it claims, but exercise caution before installing or providing secrets. Specific recommendations: - The skill requires you to paste your Ele.me browser session cookie; that cookie grants account access. Only use cookies from accounts you control and avoid pasting them on shared or untrusted machines. - The cookie is stored in plaintext at ~/.openclaw/skills/eleme-food-recommend/config.json. Consider restricting file permissions (chmod 600) or removing the cookie from disk after use. - The eleme_api module disables SSL verification (ssl.verify_mode = CERT_NONE and check_hostname = False). This weakens TLS and makes requests vulnerable to man-in-the-middle interception of your cookie. If you plan to use this, edit create_ssl_context() to use the default, secure SSL context. - Inspect and run the code locally rather than running unknown binaries. Because this is pure Python making HTTP requests, review or modify it to use more secure storage or to accept a short-lived token rather than a full session cookie. - If you want stronger assurance, ask the author for an explanation why SSL verification is disabled and for an option to store credentials encrypted or to use an OAuth/app token instead of a browser cookie.

Type: OpenClaw Skill Name: eleme-food-recommend Version: 1.0.0 The skill bundle contains a significant security vulnerability in scripts/eleme_api.py, where SSL certificate verification is explicitly disabled (ssl.CERT_NONE), making the connection susceptible to Man-in-the-Middle (MitM) attacks. Additionally, the skill requires users to input sensitive session cookies, which are stored in plaintext in a local configuration file (~/.openclaw/skills/eleme-food-recommend/config.json). While these are high-risk practices, there is no clear evidence of intentional malice or data exfiltration to unauthorized third-party domains.