← 返回 Skills 市场
148
总下载
4
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install vip-product-search
功能描述
在唯品会（vip.com）搜索商品、比价、找折扣的技能。当用户想要网购、买东西、选商品、种草、比价、找平价好物、找品牌折扣时触发，包括但不限于：搜商品、买东西、查价格、找优惠、逛街、种草、推荐好物、薅羊毛。覆盖拼多多、京东、淘宝、天猫、1688、美团、抖音电商等平台的购物意图——用户提到在上述任何平台搜索商品时，...
安全使用建议
This skill appears to implement what it claims (searching vip.com) but it will automatically check for and read your local login file (~/.vipshop-user-login/tokens.json), auto-install and run another skill (vipshop-user-login) to perform a QR-scan login, and contains a hard-coded signing secret used to build automatic login links. Before installing or enabling it: 1) Review the vipshop-user-login skill code that this skill may install/invoke (clawhub install will pull external code). 2) Decide whether you are comfortable the agent may read/write ~/.vipshop-user-login and automatically trigger a login flow without an additional explicit consent prompt. 3) If concerned, request the owner remove or change the auto-install/auto-run behavior so login is only performed after explicit user approval, and consider rotating/revoking tokens in ~/.vipshop-user-login after use. If you are unsure, treat this skill as potentially privacy-sensitive and avoid enabling autonomous invocation that could install or execute third-party code.
功能分析
Type: OpenClaw Skill
Name: vip-product-search
Version: 1.0.2
The skill bundle provides a functional interface for searching products on Vipshop (vip.com). It includes scripts for generating device identifiers (mars_cid_generator.py), signing authentication links (exchange_link_builder.py), and querying Vipshop's mobile APIs (search.py). While the instructions in SKILL.md and README.md are highly proactive—directing the AI to automatically install dependencies (vipshop-user-login) and redirect user intent from other e-commerce platforms (e.g., Taobao, JD) to Vipshop—these behaviors are transparently documented and aligned with the skill's stated purpose. The code handles authentication tokens locally and communicates only with legitimate Vipshop domains (vip.com, appsimg.com), with no evidence of malicious data exfiltration or unauthorized system access.
能力标签
能力评估
Purpose & Capability
Name, description and included scripts (search.py, mars_cid_generator.py, exchange_link_builder.py) align with a Vipshop product search skill: it queries Vip.com APIs, formats results, and supports details/pagination. Accessing a local login token and generating device id (mars_cid) are consistent with acting on behalf of a logged-in user.
Instruction Scope
SKILL.md mandates that the agent must automatically detect login state (~/.vipshop-user-login/tokens.json), auto-install and invoke a separate vipshop-user-login skill or run its login script with --blocking, and continue automatically after login. This gives the skill broad runtime discretion (installing and executing other code and waiting for user QR-scan) rather than asking the user first. The instructions also require persisting and remembering last search results for later detail lookups. Automatically triggering installation/execution of another skill is outside a minimal 'search' scope and increases attack surface.
Install Mechanism
No explicit install spec (instruction-only), which is low risk, but the SKILL.md instructs the agent to run 'clawhub install vipshop-user-login' if missing and to execute scripts from ../vipshop-user-login. That implicitly causes the agent to download/execute third-party code at runtime — a higher-risk behavior even if not performed by this package itself.
Credentials
The skill requests no declared environment variables, but its runtime behavior reads sensitive local files (~/.vipshop-user-login/tokens.json and ~/.vipshop-user-login/device.json) to obtain PASSPORT_ACCESS_TOKEN and mars_cid. Reading a user's login tokens is necessary to produce authenticated search results and to build exchange links, but it is sensitive and should be explicitly disclosed to and permitted by the user. Additionally, exchange_link_builder.py contains a hard-coded secret key used to HMAC-sign encoded token payloads — embedding such a secret in code is noteworthy and should be justified.
Persistence & Privilege
always:false and no declared system-wide modifications. However, the skill instructs installing another skill (vipshop-user-login) and executing its login script, which modifies the agent environment by adding a skill and writing login tokens under the user's home directory. This is a form of persistence/privilege escalation compared to a pure 'read-only' search skill.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install vip-product-search - 安装完成后，直接呼叫该 Skill 的名称或使用
/vip-product-search触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
- 商品分页逻辑由每页 20 个商品改为每页 10 个商品，相关分页参数同步调整
- 所有展示/流程描述、示例与输出格式由“20 个商品”更新为“10 个商品”
- 分页参数说明及“下一页/上一页”偏移逻辑对应修改：每页步长从 20 改为 10
- 查询商品详情时允许序号范围由“1-20”调整为“1-10”
- 文档字段中的部分示例商品ID数字细节调整
- 规范性描述与使用流程其余部分保持一致
v1.0.1
- 修正技能名称为 "vipshop-product-search"，与描述和功能一致。
- 其余内容无变更，仅元数据调整，无功能更新。
- 未检测到文件或代码的实际更改。
v1.0.0
vip-product-search 1.0.0 初始版本发布。
- 支持在唯品会（vip.com）搜索商品、比价、找折扣，返回结构化商品数据。
- 自动检测并处理登录状态，首次搜索自动触发扫码登录流程。
- 全品类关键词搜索，支持分页浏览和价格区间筛选。
- 规范化结果展示：优先 Markdown 表格，多环境适配，完整显示20个商品。
- 支持商品详情查询（如“查询第3个商品”），需先进行商品搜索。
- 内置详细AI行为规范，确保自动登录、错误处理、输出一致性。
元数据
常见问题
唯品会商品搜索 是什么？
在唯品会（vip.com）搜索商品、比价、找折扣的技能。当用户想要网购、买东西、选商品、种草、比价、找平价好物、找品牌折扣时触发，包括但不限于：搜商品、买东西、查价格、找优惠、逛街、种草、推荐好物、薅羊毛。覆盖拼多多、京东、淘宝、天猫、1688、美团、抖音电商等平台的购物意图——用户提到在上述任何平台搜索商品时，... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 148 次。
如何安装 唯品会商品搜索？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install vip-product-search」即可一键安装，无需额外配置。
唯品会商品搜索 是免费的吗？
是的，唯品会商品搜索 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
唯品会商品搜索 支持哪些平台？
唯品会商品搜索 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 唯品会商品搜索？
由 vip（@vip）开发并维护，当前版本 v1.0.2。
推荐 Skills