← 返回 Skills 市场

Lucky Gumroad Automation

Name: Lucky Gumroad Automation
Author: rmbell09-lang

作者 rmbell09-lang · GitHub ↗ · v1.0.1 · MIT-0

cross-platform ⚠ suspicious

110

总下载

当前安装

版本数

在 OpenClaw 中安装

/install lucky-gumroad

功能描述

Gumroad store automation — product creation, uploads, profile editing, data pulls. Use when any task involves Gumroad (creating products, managing listings,...

使用说明 (SKILL.md)

Gumroad Automation Skill

Authentication

Session is pre-authenticated. Never log in manually. Always reuse the saved Chrome profile.

Chrome Profile

Path: /home/openclaw/gumroad-profile

Rules (non-negotiable):

Always use --user-data-dir=/home/openclaw/gumroad-profile
Never clear cookies
Never use incognito/guest mode
Never run as root

Quick Session Test

timeout 20 google-chrome \
  --user-data-dir=/home/openclaw/gumroad-profile \
  --headless=new --no-sandbox --disable-gpu \
  --disable-dev-shm-usage \
  --dump-dom https://gumroad.com/dashboard \
  > /tmp/gumroad-test.html 2>/dev/null

grep -E "Dashboard/Index|logged_in_user|current_seller" /tmp/gumroad-test.html | head

If grep returns lines → session valid ✅
If URL is /login?next=%2Fdashboard → session expired ❌ (tell Ray)

Headless Chrome Launch (for automation)

google-chrome \
  --user-data-dir=/home/openclaw/gumroad-profile \
  --headless=new \
  --no-sandbox \
  --disable-gpu \
  --disable-dev-shm-usage \
  --remote-debugging-port=9222 \
  "https://gumroad.com/dashboard" &

Puppeteer / Playwright

// Puppeteer
const browser = await puppeteer.launch({
  headless: 'new',
  userDataDir: '/home/openclaw/gumroad-profile',
  args: ['--no-sandbox', '--disable-gpu', '--disable-dev-shm-usage']
});

// Playwright
const context = await chromium.launchPersistentContext('/home/openclaw/gumroad-profile', {
  headless: true,
  args: ['--no-sandbox', '--disable-gpu', '--disable-dev-shm-usage']
});

Account Info

Seller: qcautonomous
Display name: RayChod
Subdomain: qcautonomous.gumroad.com
User ID: 3256469230239

Important

If session ever expires, tell Ray — don't try to log in
Kill any leftover Chrome before launching: pkill -f "chrome.*gumroad-profile" 2>/dev/null
Always wait 2 seconds after kill before relaunching

安全使用建议

This skill asks the agent to reuse a pre-authenticated Chrome profile stored at /home/openclaw/gumroad-profile but the manifest lists no required config path or credentials — that mismatch is the main red flag. Before installing or running: 1) Ask the skill author to explicitly declare and justify the required config path and any sensitive artifacts; prefer an API-based auth (Gumroad API token) rather than reusing a browser profile. 2) If you must run it, do so in an isolated VM/container with a dedicated Chrome profile created just for automation (do not reuse a personal system profile). 3) Inspect the profile directory to understand what it contains (cookies, localStorage, saved passwords) and limit its filesystem permissions. 4) Block/monitor network egress from the runtime environment and review logs for unexpected outbound connections. 5) Require the author remove or explain 'Never log in manually' and the instruction to always reuse the profile, and provide a fallback/auth-refresh mechanism that does not rely on opaque human instruction. If the author cannot justify the undeclared filesystem access, do not grant the skill access to your system profile.

能力评估

⚠ Purpose & Capability

The skill's stated purpose (Gumroad automation) legitimately requires authenticated sessions, and reusing a Chrome profile can achieve that. However, the skill manifest declares no required config paths or credentials while the SKILL.md mandates use of a specific local profile path (/home/openclaw/gumroad-profile). That contradiction (an undeclared but required sensitive resource) is incoherent and should have been declared explicitly.

⚠ Instruction Scope

The SKILL.md instructs the agent to: reuse a local Chrome user-data directory, never clear cookies, run headless Chrome with remote debugging, dump DOM to /tmp, pkill Chrome processes, and never log in manually. These are system-level operations and direct access to a local browser profile (cookies, localStorage, tokens). The instructions do not declare or justify this sensitive filesystem access, and include social-engineering-like guidance ('Never log in manually' / 'tell Ray'), which broadens the operational scope beyond a simple API integration.

✓ Install Mechanism

This is an instruction-only skill with no install spec and no code files. That minimizes risk from arbitrary installation artifacts or remote downloads.

⚠ Credentials

No environment variables, credentials, or config paths are declared in the registry metadata, yet the runtime instructions require direct access to a Chrome profile directory that effectively contains credentials (session cookies, auth tokens). Requesting access to that profile is equivalent to requesting sensitive credentials and should be explicitly declared and justified. The presence of hard-coded account identifiers (seller name, user id, subdomain) ties the profile to a specific account and increases risk if the profile is misused or exfiltrated.

ℹ Persistence & Privilege

The skill is not marked 'always: true' and is user-invocable (normal). However, because the agent is allowed to invoke skills autonomously by default, the combination of autonomous invocation with undeclared access to a persistent browser profile increases the potential blast radius. The skill also instructs the agent to kill and relaunch Chrome processes, which affects system state.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install lucky-gumroad
安装完成后，直接呼叫该 Skill 的名称或使用 /lucky-gumroad 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.1

Version 1.0.1 of lucky-gumroad - No code or documentation changes detected in this release. - All usage instructions, authentication steps, and session handling guidelines remain unchanged.

v1.0.0

Initial release of Gumroad store automation skill. - Enables automation of Gumroad tasks such as product creation, uploads, profile editing, and data retrieval. - Requires use of a pre-authenticated Chrome profile at `/home/openclaw/gumroad-profile`; manual login is never permitted. - Provides clear instructions for session validation and automated browser setup using headless Chrome. - Includes best practices for using Puppeteer or Playwright with the saved session. - Outlines procedures for handling expired sessions and safe browser relaunch.

元数据

Slug lucky-gumroad

版本 1.0.1

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题