Shopping in Sweden

Assist with searching, adding to cart, and securely purchasing products from trusted Swedish e-commerce sites using the Zupyak Mynt Card.

Key things to consider before installing or enabling this skill: - The skill's runtime explicitly reads sensitive files from your home directory (~/Private/用户个人信息.txt and files containing the 'Zupyak Mynt Card'). The registry metadata does NOT declare these config paths — ask the author to declare them and explain why those exact files are required. - The skill uses the local CDP endpoint (ws/http on 127.0.0.1:18800) to control iframes and inject mouse/key events. CDP access can interact with any open browser target and potentially see other pages/tabs. Only allow this skill if you trust its source and you are comfortable with that level of local browser control. - There are hard-coded example card details in the reference files. Confirm these are dummy/test values; never store real card numbers in plaintext files in your home directory. Consider using ephemeral/virtual card numbers (bank-provided one-time cards) instead of a persistent file. - If you want to proceed, require these mitigations: (1) insist the skill author update metadata to list required config paths and any other secrets; (2) require explicit, per-order user confirmation (the SKILL.md already says so — verify the agent enforces it); (3) avoid storing real cards in cleartext and prefer short-lived tokens; (4) run the skill in a restricted/test environment first and monitor network/DevTools activity; (5) prefer manual checkout for high-value purchases. If you cannot get the author to declare and justify the local-file access and to remove hard-coded sensitive values, treat the skill as untrusted and do not enable it with access to your real payment/recipient files.

Type: OpenClaw Skill Name: shopping-in-se Version: 1.0.0 The skill facilitates automated online shopping by instructing the agent to read sensitive PII and credit card details from local files (~/Private/) and use the Chrome DevTools Protocol (CDP) to bypass iframe security boundaries. The provided Python code in 'references/cdp-click.md' uses low-level socket communication to interact with the browser's CDP interface (localhost:18800), allowing it to programmatically enter card data and trigger clicks inside cross-origin payment iframes (Klarna/Stripe). While the skill includes safety instructions like user confirmation and a 'trusted sites' list, the combination of local secret access and the ability to bypass browser security controls for financial transactions represents a high-risk capability.