After-sales Service

售后管理技能，提供客户投诉管理、返单报价、满意度调查、分析报表和 OKKI CRM 同步功能。

This skill appears to implement the advertised after-sales and OKKI sync features, but you should take these precautions before installing or running it: - Runtime requirements: The code expects Node.js and python3 on PATH, plus local OKKI client scripts (okki_cli.py / okki_client.py) reachable via OKKI_* env vars. The registry metadata did not declare these — ensure you have Node and python3 and set OKKI_WORKSPACE_PATH / OKKI_CLI_PATH / OKKI_CLIENT_PATH to trusted locations. - Review OKKI client code: The skill executes those Python scripts and, as a fallback, writes and runs a temporary Python script in /tmp. Verify the okki_cli.py / okki_client.py files (and any code in the referenced xiaoman-okki workspace) are from a trustworthy source before allowing the skill to run, since they will run as processes on your host. - Temporary file writes and execution: The controller writes a temp .py file to /tmp and executes it. If you run this on a shared or production host, prefer an isolated environment (container/VM) and avoid using production credentials until you confirm behavior. - Missing .env.example and metadata gaps: SKILL.md tells you to copy .env.example but that file wasn't found in the manifest; confirm configuration steps with the author. Also the skill does not declare required envs/binaries formally — assume they are required and validate before use. - Sanity-check data flows: The sync uses content assembled from complaint data and passes it to the OKKI client. While arguments are passed to execFile (not a shell), check that business data cannot cause malformed Python code in the fallback path (there are some string interpolation and quoting choices in the temp script that could break or behave unexpectedly). If you are not able to audit the OKKI client code or do not want to run external Python code on your host, run the skill in a sandboxed environment or decline installation.

Type: OpenClaw Skill Name: ssa-after-sales Version: 1.0.0 The skill bundle exhibits high-risk execution patterns, specifically in `api/controllers/okki_sync_controller.js`, where it dynamically generates Python scripts in the `/tmp` directory and executes them using `child_process.execFile`. While intended for OKKI CRM integration, this approach is vulnerable to code injection if input sanitization (e.g., handling of triple quotes in Python) is bypassed. Additionally, the code relies on hardcoded relative paths that reach four levels outside the skill's root directory to access external scripts (`okki_cli.py`), which is a fragile and potentially exploitable configuration.