Order Tracker

Track and manage sales orders with status updates, notifications, and dashboard reporting. Supports order creation, status transitions (pending/confirmed/shi...

What to check before installing/using this skill: - SMTP credentials: send-order-notification.js loads SMTP config from ../../imap-smtp-email/.env. Confirm you have (or want to provide) SMTP_HOST/SMTP_USER/SMTP_PASS and related settings, and that you trust the imap-smtp-email skill and its .env file location. The skill metadata does not declare these env vars — treat this as a manual dependency. - File writes: update-order-status.js will modify data/orders.json (creates a .bak) and append to logs/status-changes.log. Run with --dry-run first and inspect the backup before letting it write in production. - Arbitrary paths: both update and notification scripts accept --orders-file to point to any path; only run these scripts as a user who controls the supplied file paths. Avoid running them as a privileged user or from automated agents with access to sensitive directories. - Email behavior: the notification script will connect to the SMTP host and send emails with order content (customer names/emails/order details). Verify you want these messages sent from the configured SMTP account. - Origin and trust: source/homepage are unknown. The code is readable and unsurprising, but the skill accesses another skill's .env and does network I/O. If you plan to use it, review the imap-smtp-email .env contents, run smoke tests in the repo (smoke-test.sh uses dry-run), and consider running in an isolated workspace or container first.

Type: OpenClaw Skill Name: ssa-order-tracker Version: 1.0.0 The order-tracker skill provides functionality for managing sales orders and sending customer notifications. The script `scripts/send-order-notification.js` contains a risky behavior where it performs a directory traversal to access sensitive SMTP credentials from a sibling skill's directory (`../../imap-smtp-email/.env`). While this cross-skill dependency is explicitly documented in `SKILL.md` and `README.md` as a prerequisite, it represents a security vulnerability by breaking directory isolation and assuming access to external secrets. No evidence of intentional malice, such as unauthorized data exfiltration or backdoors, was found in the code logic.