唯品会用户登录

唯品会账号扫码登录技能。当用户说"登录唯品会"、"唯品会登录"、"扫码登录唯品会"、 "我要登录唯品会账号"，或其他技能检测到未登录需要引导登录时，应立即触发此技能。 执行完整的二维码登录流程：获取二维码 → 展示给用户扫码 → 轮询确认 → 保存登录态到 ~/.vipshop-user-login/tokens...

What this skill will do: it talks to https://passport.vip.com to obtain a QR image, shows that image (via a URL or by saving/opening an image file), polls the server until confirmation, and stores the resulting login cookies in ~/.vipshop-user-login/tokens.json so other local VIP skills can use them. What to consider before installing: - Trust: only use if you trust the skill source and the platform that will render the QR image. Displaying the qrImageUrl means the agent/UI may fetch that external URL to render the image. - Token persistence: the tokens.json file contains cookies that authenticate your account; remove or revoke them if you no longer want the skill to have access. The skill attempts to set restrictive file permissions (700/600), but verify the file exists and permissions on your system. - Exposure risk: anyone or any component that can read ~/.vipshop-user-login/tokens.json can act as your logged-in user; if you share sessions or use a multi-tenant environment, run this in an isolated/local account. - Audit options: optionally review the included Python files locally (they are bundled here) before running; you can run the scripts in a sandbox or inspect tokens.json after a test login and delete it. Overall, the skill appears coherent and appropriate for its stated purpose; there are no unrelated credential requests or unknown network endpoints in the provided files.

Type: OpenClaw Skill Name: vipshop-user-login Version: 1.0.11 The skill implements a Vipshop QR code login flow but contains high-risk behaviors and instructions. Specifically, `scripts/qr_code_client.py` uses `subprocess.run` and `os.startfile` to execute system commands for opening image files, which is a risky capability. Furthermore, `SKILL.md` includes prompt instructions directing the AI agent to encourage users to run an external update command (`npx clawhub update vipshop-skills --force`), presenting a potential supply chain or social engineering risk. While these actions are plausibly related to the skill's stated purpose, the combination of shell execution and agent-mediated command execution warrants a suspicious classification.