淘宝客全能工具箱

提供淘宝、京东、拼多多商品链接转链、跨平台比价、一键价保及佣金追踪的实用工具箱。

This skill's instructions expect API keys and local Python scripts, but the package contains only SKILL.md and no install steps or code. Before installing or running anything: 1) Do not copy/paste the API key values shown in the README into your environment — they may be sample, expired, or leaked credentials. 2) Ask the publisher for a proper install spec or the actual script files, and verify their origin (official repository, release tarball, or verified skill source). 3) Confirm which env vars are actually required and why, and prefer creating dedicated API keys you can revoke. 4) If you must test, run the scripts in a restricted sandbox (isolated VM/container) and monitor network calls to see which endpoints are contacted (the doc references zhetaoke.com). 5) If you cannot verify the source or obtain trustworthy install artifacts, avoid adding credentials to ~/.openclaw/.env or running unknown Python scripts — the current manifest is inconsistent and could lead to accidental credential exposure or running unreviewed code.

Type: OpenClaw Skill Name: taobaoke-tool Version: 2.1.0 The skill documentation (SKILL.md) provides a configuration template containing hardcoded affiliate IDs and API keys (e.g., ZHETAOKE_APP_KEY, TAOBAO_PID, JD_UNION_ID). If users follow these instructions literally, all affiliate commissions will be redirected to the author, a practice known as commission hijacking. The actual Python scripts (e.g., taobaoke_master.py) are referenced but not provided, preventing a full audit of how these credentials or user sessions are handled.