Taobao Query

Query Taobao product prices and information through MCP (Model Context Protocol). Use when the user asks about product prices, searches for items on Taobao,...

This skill can control a Taobao client via an MCP server and read sensitive, authenticated data (cart, orders, browsing history). Before installing: only use it if you trust the skill source; ensure TAOBAO_MCP_URL is left at the localhost default (http://127.0.0.1:3654/mcp) and do NOT point it to remote or untrusted hosts; consider using a separate/no-payment Taobao account for testing; restrict or disable autonomous invocation if possible; review network/firewall rules so the MCP port is not exposed publicly; and monitor the Taobao account for unexpected activity. If you need stronger assurance, ask the skill author to require/confirm localhost-only MCP use and to document exactly which MCP tool calls will run for each user request.

Type: OpenClaw Skill Name: taobao-query Version: 1.0.0 The taobao-query skill provides an interface for an AI agent to interact with Taobao via a local Model Context Protocol (MCP) server. While the instructions in SKILL.md include safety guardrails against financial transactions, the skill grants high-risk capabilities including 'navigate_to_url', 'input_text', and 'get_browse_history', which allow for broad browser automation and access to sensitive user data. The dependency on a specific local 'Taobao Desktop Client' to host the service at http://127.0.0.1:3654/mcp is a significant external requirement that could be used as a vector for local service exploitation or social engineering, placing it in the suspicious category despite the lack of clear malicious intent.