← 返回 Skills 市场
102
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install pinkr-openapi-skill
功能描述
品氪提供的OpenApi开放平台，支持门店、导购、会员、订单、退单、库存、商品、积分、储值、卡券、销售等全链路CRM/SCRM数据同步与管理。通过安全认证的API接口实现第三方系统与品氪平台的数据互通。
安全使用建议
Before installing: (1) Verify the PK_API_URL value points to an official Pinkr endpoint (production vs dev) and that you trust that host. (2) Expect to provide a secret PK_APPKEY — confirm the registry-level metadata omission is just an error and not an attempt to hide credential use. (3) Review the included Python script yourself (it posts form data to the configured URL and writes results to a local 'output' folder); run it in an isolated environment if possible. (4) Avoid supplying unrelated credentials; the skill only needs one app key and an API base URL. (5) If you need higher assurance, ask the publisher for a canonical homepage/source or signed releases, or request the skill be repackaged so registry metadata matches the SKILL.md.
功能分析
Type: OpenClaw Skill
Name: pinkr-openapi-skill
Version: 1.0.1
The skill provides a comprehensive interface for the Pinkr OpenAPI to manage CRM/SCRM data. However, it is classified as suspicious because both the documentation (SKILL.md) and the implementation (pinkr_openapi_skill.py) default to an insecure HTTP endpoint (http://dev.openapi.pinkr.com). This vulnerability allows for the interception of sensitive information, including the PK_APPKEY (used as the appid in requests) and customer data such as member details and order history. While the code logic appears aligned with its stated purpose and lacks evidence of intentional malice, the use of unencrypted transport for authentication tokens and PII is a significant security flaw.
能力评估
Purpose & Capability
The skill's name, description, SKILL.md, and the Python code all align: they call Pinkr OpenAPI endpoints for CRM/SCRM operations. Declared API usage (method, appid, data, v) and endpoints in code match the described purpose. However the registry-level metadata (shown earlier) indicates no required env vars/primary credential while SKILL.md and the code require PK_APPKEY (and optionally PK_API_URL) — an inconsistency between manifest and SKILL.md.
Instruction Scope
Runtime instructions and the implemented code focus on making POST requests to the configured PK_API_URL using PK_APPKEY and formatting/saving results. The SKILL.md does not instruct the agent to read unrelated files, system credentials, or exfiltrate data to other endpoints. The code writes results to an 'output' directory under the skill — this is scope-consistent but should be noted.
Install Mechanism
No install spec is provided (instruction-only plus a small Python script). The included requirements.txt only lists 'requests' which is a common dependency. No unusual downloads, URL shorteners, or archive extraction were observed.
Credentials
The SKILL.md and script legitimately require a single secret (PK_APPKEY) and an optional PK_API_URL — proportionate to the stated functionality. However the registry metadata at the top of the package incorrectly lists 'Required env vars: none' and 'Primary credential: none', creating an inconsistency about credential needs. This mismatch could confuse users and automated permission checks; confirm that PK_APPKEY is the only credential the skill needs and verify it is sent only to the expected PK_API_URL.
Persistence & Privilege
The skill does not request always:true and is user-invocable. It does not modify other skills or system-wide settings. It does write output files into an 'output' directory under the skill — local persistence limited to that folder.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install pinkr-openapi-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/pinkr-openapi-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
No user-visible changes in this update.
- Version incremented to 1.0.1.
- No file changes detected.
v1.0.0
品氪 OpenApi 开放平台 Skill 1.0.0 – 初始发布
- 首次上线，提供品氪全链路 CRM/SCRM 数据同步与管理的 OpenAPI Skill。
- 覆盖门店、导购、会员、订单、退单、库存、商品、积分、储值、卡券、销售数据、营销分析等模块的标准 API 接口对接与说明。
- 支持自动意图识别并调用相应 API，简化第三方系统与品氪平台数据互通对接。
- 明确所有功能、API 参数、状态码等完整文档，便于开发与配置。
元数据
常见问题
品氪 OpenApi 开放平台 Skill 是什么？
品氪提供的OpenApi开放平台，支持门店、导购、会员、订单、退单、库存、商品、积分、储值、卡券、销售等全链路CRM/SCRM数据同步与管理。通过安全认证的API接口实现第三方系统与品氪平台的数据互通。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 102 次。
如何安装 品氪 OpenApi 开放平台 Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install pinkr-openapi-skill」即可一键安装，无需额外配置。
品氪 OpenApi 开放平台 Skill 是免费的吗？
是的，品氪 OpenApi 开放平台 Skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
品氪 OpenApi 开放平台 Skill 支持哪些平台？
品氪 OpenApi 开放平台 Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 品氪 OpenApi 开放平台 Skill？
由 ikaijian（@ikaijian）开发并维护，当前版本 v1.0.1。
推荐 Skills