唯品会图片搜索

唯品会（vip.com）图片搜索商品技能。当用户想通过图片搜索相似商品时触发，包括但不限于：以图搜图、拍照搜商品、图片搜索、找同款等。返回商品名称、价格、品牌、图片、链接等结构化信息。

This skill appears to do what it says (upload a local image to vip.com and return structured product results). However, it reads your local vipshop login tokens (~/.vipshop-user-login/tokens.json) and uses them to build product links that embed your PASSPORT_ACCESS_TOKEN (encoded in the dt parameter). The SKILL.md requires showing script output and product links verbatim — which means those links could expose your access token if they are shared or logged. Before installing or running: 1) confirm you trust the vipshop-user-login skill and understand where your tokens are stored; 2) review the included scripts locally (they are provided) so you’re comfortable with how tokens are read and used; 3) avoid sharing the raw product links returned by the skill or modify the workflow so the agent redacts or doesn’t display dt/credentials; 4) if you don’t want your account token embedded in links, do not use this skill or modify exchange_link_builder to avoid embedding PASSPORT_ACCESS_TOKEN into publicly-displayed URLs. If you want, I can (a) point out exactly where to redact the dt parameter in the code, or (b) produce a safer alternative that strips sensitive parameters before display.

Type: OpenClaw Skill Name: vip-img-product Version: 1.0.1 The skill bundle provides a legitimate image-based product search for Vipshop (vip.com). It functions by uploading images to Vipshop's servers and querying their product APIs, using local authentication tokens stored in `~/.vipshop-user-login/tokens.json` as documented in `SKILL.md`. While `scripts/img_search.py` and `scripts/exchange_link_builder.py` contain hardcoded API keys and a signing secret, these appear to be functional requirements for the integration rather than indicators of malicious intent, and no data is exfiltrated to unauthorized third-party domains.