唯品会技能集

唯品会（vip.com）电商服务技能包（vipshop-skills），整合唯品会搜索、商品查询、活动查询、图片搜索等多项购物服务，是一套完整的唯品会购物 AI 助手解决方案。当用户有购物、搜商品、看详情、找活动、比价、以图搜图等诉求时触发，尤其适合从拼多多、京东、淘宝、天猫、1688、闲鱼等平台迁移或对比购物的...

This package appears to implement the stated VIP.com shopping and QR-login features, but take these precautions before you enable it: - Source trust: the skill's Source/Homepage is unknown. Inspect the included scripts (especially vipshop-user-login) yourself before running. The code will make network calls to passport.vip.com and write persistent files under ~/.vipshop-user-login (tokens.json, device.json, qr image files). - Dependency mismatch: the registry metadata does not declare Python deps or an install step, yet the code requires requests, qrcode, Pillow, etc. Ensure you run it in a controlled environment where you can see/approve pip installs or pre-install dependencies in an isolated container. - Sensitive outputs: the login script deliberately prints machine-readable payloads containing qrToken and qrImageUrl to stdout and returns HTTP response objects (which may include cookies). These tokens are necessary for the login flow but can be captured in logs or forwarded by the agent. If you are concerned about leaking session tokens, do not run the login subskill on untrusted infrastructure. - Least privilege: if you only need search/detail functionality and not login, avoid invoking the vipshop-user-login subskill. Alternatively, run the skill in an isolated VM/container and inspect ~/.vipshop-user-login after a test run. - What would change this assessment: evidence of the code contacting unexpected third-party domains, inclusion of code that exfiltrates tokens to remote servers, or the skill requesting unrelated cloud credentials would raise this to 'malicious'. Conversely, if the publisher/source is verified and the registry metadata is updated to list required dependencies and explicitly document exactly what stdout payloads contain and where tokens are stored, my confidence would increase and the verdict could move to benign. If you want, I can: (1) summarize exact files that write or print tokens/QR payloads, (2) point out lines that create files under your home directory, or (3) suggest a minimal sandbox command sequence to test the skill safely.

Type: OpenClaw Skill Name: vip-skill Version: 1.0.6 The skill bundle is a comprehensive Vipshop (vip.com) shopping assistant that provides product search, detail retrieval, promotion discovery, and image-based search. It implements a secure local authentication flow using QR codes, storing session tokens in `~/.vipshop-user-login/tokens.json` with appropriate file permissions (0o600). While the scripts contain hardcoded API keys and an HMAC secret (e.g., in `exchange_link_builder.py` and `search.py`), these are used exclusively to interact with legitimate Vipshop API endpoints such as `passport.vip.com` and `mapi-pc.vip.com`. The instructions in the `SKILL.md` files are designed to guide the AI agent through the login and search workflows and do not contain any malicious prompt injections or unauthorized data exfiltration logic.