← 返回 Skills 市场
Online Shopping
作者
Filip Martinsson
· GitHub ↗
· v1.0.0
710
总下载
1
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install online-shopping
功能描述
Browse and buy products from online stores, including Cloudflare-protected sites. Use when the user asks to find, compare, or order products online. Handles...
安全使用建议
This skill appears to do what it claims, but it has real system impact and handles sensitive data. Before installing: (1) Review setup.sh because it runs package manager installs (sudo) and npm installs into your OpenClaw path—run it in a VM or controlled environment if you’re cautious. (2) Expect Chrome/Chromium and xvfb to be installed; check the integrity of any npm packages (patchright). (3) The skill will read and persist addresses and payment-method names in references/preferences.md and may fill checkout forms—do not store full card numbers there, and only provide payment details interactively when needed. (4) Consider legal/terms-of-service implications: Patchright is explicitly used to evade bot detection (Cloudflare); using it may violate some sites' terms. (5) If you proceed, inspect references/preferences.md and USER.md contents and run setup manually step-by-step rather than blindly executing the script.
功能分析
Type: OpenClaw Skill
Name: online-shopping
Version: 1.0.0
The skill is classified as suspicious due to several high-risk capabilities and potential vulnerabilities, despite its stated benign purpose. The `scripts/setup.sh` file uses `sudo` to install system-level packages (xvfb), which involves privilege escalation. More critically, the `SKILL.md` instructions guide the AI agent to execute shell commands directly, such as `xvfb-run --auto-servernum node <skill-dir>/scripts/browse.mjs "<url>"`. Although the example shows the URL quoted, if the AI agent fails to properly quote the `<url>` argument when constructing this command, it creates a shell injection vulnerability (RCE). Additionally, `scripts/browse.mjs` uses `node:child_process.execSync`, a pattern that can lead to RCE if used with untrusted input, though in this specific instance it's used for a non-user-controlled path lookup.
能力评估
Purpose & Capability
The name/description (browse and buy on protected sites) aligns with the included scripts and docs: setup.sh installs xvfb, Patchright, and a browser; browse.mjs uses Patchright to navigate, extract text, screenshot, and operate checkout forms. These requirements are proportionate for the stated goal of bypassing anti-bot detection and automating shopping flows.
Instruction Scope
SKILL.md and the scripts instruct the agent to search, extract product info, fill checkout forms, and update a local preferences file with addresses/payment-method names. This stays within the shopping scope but implies handling of sensitive user data (addresses, payment method names) and directs bypassing anti-bot measures (Patchright). The skill explicitly says to stop before paying, which limits risk, but filling payment/checkout forms is intrinsic and sensitive.
Install Mechanism
There is no registry install spec, but setup.sh installs Patchright via npm and uses npx to install Chrome/Chromium and system deps; it also installs xvfb via the system package manager (sudo). This is expected for a stealth browser but carries moderate system-level risk (requires sudo, writes into OpenClaw's install path, and downloads packages from npm). No obscure URLs or archive downloads are used.
Credentials
The skill requests no environment variables or external credentials. However it expects and encourages storing user contact/addresses and payment method names in references/preferences.md and may read USER.md. Access to that local sensitive data is proportional for checkout automation but should be considered sensitive by the user.
Persistence & Privilege
always:false and the skill does not request persistent platform privileges. The installer does modify the local OpenClaw installation directory (npm install patchright) and places a persistent browser context in /tmp, which is standard for this workflow and within scope, but users should be aware of those artifacts.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install online-shopping - 安装完成后，直接呼叫该 Skill 的名称或使用
/online-shopping触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial release of the "online-shopping" skill for browsing and buying products from online stores, including those protected by Cloudflare.
- Uses Patchright (stealth Playwright) scripts and xvfb to bypass bot detection and enable automated shopping workflows.
- Supports product search, price comparison, adding to cart, and automated checkout—always stopping for user confirmation before payment.
- Provides step-by-step guidance for running and customizing Patchright scripts, highlighting critical bot evasion practices.
- Integrates user preferences and addresses from local references files to streamline checkout, with clear safety measures to prevent accidental purchases.
元数据
常见问题
Online Shopping 是什么？
Browse and buy products from online stores, including Cloudflare-protected sites. Use when the user asks to find, compare, or order products online. Handles... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 710 次。
如何安装 Online Shopping？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install online-shopping」即可一键安装，无需额外配置。
Online Shopping 是免费的吗？
是的，Online Shopping 完全免费（开源免费），可自由下载、安装和使用。
Online Shopping 支持哪些平台？
Online Shopping 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Online Shopping？
由 Filip Martinsson（@filipmartinsson）开发并维护，当前版本 v1.0.0。
推荐 Skills