search-1688-supplier

通过 AlphaShop API 搜索和筛选1688供应商。支持三种输入方式： 1688商品链接（查找特定商品的供应商）、图片URL（以图搜货）、 文字关键词（按关键词搜索供应商）。支持按最高价格、最大起批量、 最低48H发货率进行筛选。适用于查找1688供应商、搜索工厂、 以图找商、找供应商、搜商家等场景。

This skill appears to implement exactly what it says: it calls AlphaShop APIs and filters results locally. Before installing or running it, note the following: - You must provide ALPHASHOP_ACCESS_KEY and ALPHASHOP_SECRET_KEY; the code will exit if they are missing. The registry metadata incorrectly omits these required env vars — do not rely on the registry to surface required secrets. - Supplying the secret key gives the skill the ability to generate JWTs and call AlphaShop on your behalf. Only provide keys you trust the recipient/service with; prefer using credentials scoped/rotated specifically for this integration. - The script sends user-supplied URLs (including image URLs) to AlphaShop. Do not pass any private/local URLs or sensitive links you don't want sent to an external service. - The package owner/homepage is unknown. If you need higher assurance, ask the publisher for provenance (source repo, project homepage) or run the code in an isolated environment to inspect behavior before supplying secrets. - If you proceed, install dependencies in a virtualenv and consider creating AlphaShop API credentials with minimal permissions and the ability to revoke them quickly. If you want, I can: (1) show the full remaining portion of scripts/search.py (it was truncated in the manifest) to double-check there are no hidden behaviors; (2) suggest a checklist for verifying the publisher; or (3) produce a minimal sandboxed command to run the script safely.

Type: OpenClaw Skill Name: search-1688-supplier Version: 1.0.4 The skill is a legitimate tool for searching 1688 suppliers via the AlphaShop API. The main script (`scripts/search.py`) uses standard libraries to handle API authentication via JWT and perform searches based on text, image URLs, or product links. The instructions in `SKILL.md` provide operational guidance for the AI agent without any evidence of prompt injection or malicious intent. No data exfiltration, unauthorized execution, or obfuscation was found.