Qfc Order

Automates adding unchecked grocery-list items to QFC online cart, adjusts quantities, confirms cart details, and schedules a pickup slot via attached Chrome...

This skill appears to do what it says: it automates adding items to QFC using a Chrome tab you must attach and a grocery-list file from another skill. Before installing or running it: 1) Understand that attaching your browser tab gives the agent access to the logged-in web session (so only attach a tab where you are intentionally logged into QFC and not other sensitive sites). 2) Review the grocery-list file (skills/grocery-list/grocery-list.json) to ensure it contains only shopping items and no secrets. 3) Be prepared to confirm actions — the skill prompts for user confirmation, and you should review the cart/total before finalizing any order. 4) Ensure the browser-relay extension or toolbar button you use is trustworthy, since it exposes the tab DOM/cookies to the agent. If you need stronger assurance, prefer manual ordering or a skill that uses an explicit API key workflow rather than controlling a logged-in browser session.

Type: OpenClaw Skill Name: qfc-order Version: 1.0.0 The skill uses the `browser` tool's `evaluate` action in `SKILL.md` to execute arbitrary JavaScript within the browser context (e.g., `fn: "window.scrollTo(0, document.body.scrollHeight)"`). While this specific usage is benign and hardcoded, the `evaluate` action itself is a high-risk capability. It could be exploited for client-side prompt injection or arbitrary code execution if the `fn` parameter were dynamically constructed from untrusted input. No other evidence of intentional malicious behavior, such as data exfiltration, persistence, or agent-level prompt injection, was found.