SZZG007 Product Promotion

自动提取商品图片，生成高质量HTML推广邮件模版，支持素材库管理及邮件发送的一体化工具。

Do not install or run this skill without changes. The package contains a plaintext SMTP username and password (in send-email.py) and disables SSL certificate verification — that means emails would be sent through the author's account if you use the bundled send routine. If you still want the functionality: 1) Replace the hard-coded SMTP credentials with your own credentials stored in a secure env file and ensure the code prefers env vars (or remove the bundled credentials entirely). 2) Fix absolute paths so assets are written to a configurable, relative, or user-specific directory (do not assume /Users/zhuzhenguo). 3) Re-enable proper SSL/TLS validation for SMTP connections. 4) Inspect and test the scripts in a controlled environment (no real recipients) before sending any emails. 5) Consider rotating the exposed SMTP password if it belongs to you, and avoid using third-party credentials embedded in untrusted packages. The package is internally coherent enough to perform its advertised task, but the credential and path misconfigurations are suspicious and must be corrected before trust.

Type: OpenClaw Skill Name: szzg007-product-promotion Version: 1.0.1 The skill bundle contains hardcoded SMTP credentials (username and password) and explicitly disables SSL certificate verification in 'scripts/send-email.py'. Additionally, multiple scripts ('scripts/product-promotion.py', 'scripts/email-code-manager.py') and documentation files use hardcoded absolute paths tied to a specific local user environment ('/Users/zhuzhenguo/'), which indicates a lack of portability and potential exposure of local system structures. While these are significant security vulnerabilities and poor practices, they appear to be unintentional flaws rather than an intentional attempt to exfiltrate user data or establish a backdoor.