by 安全扫描
OpenClaw
可疑
medium confidenceOverall the code and instructions match an affiliate-marketing automation skill, but there are metadata inconsistencies and runtime behaviors (notably the ability to record synthetic clicks/conversions) and configuration quirks that could be abused or are surprising — review carefully before installing or granting credentials.
评估建议
This package appears to implement the advertised affiliate automation features, but take these precautions before installing or using it:
- Review and test the code locally first (especially src/link-tracker.js and src/product-finder.js) to confirm what network calls it makes and how it stores credentials.
- Do NOT provide high-privilege or production API keys until you trust the code. Create least-privilege / test keys or sandbox accounts for Amazon/ShareASale/CJ where possible.
- Pay special ...详细分析 ▾
ℹ 用途与能力
The skill's name, README, SKILL.md and source files implement the advertised features (product discovery, content generation, link tracking, analytics). Dependencies (axios, cheerio, node-fetch) are consistent with web API calls / scraping and content generation. Minor incoherences: package metadata uses the name 'affiliate-marketing-pro' in package.json/clawhub.json while the skill slug is 'affiliate-marketing-auto' and published version in metadata is 1.0.2 whereas package files list 1.0.0/1.0.1 — these mismatches are not necessarily malicious but indicate sloppy packaging.
⚠ 指令范围
SKILL.md and examples instruct the agent to accept and store platform API keys via configure(), search platforms, generate and publish content, and create tracking links. The examples (examples/quick-start.js) explicitly demonstrate recording '模拟点击和转化' (simulated clicks and conversions) by calling linkTracker.recordClick and recordConversion with synthetic IPs/userAgents and recording conversions. That capability—especially when used with fabricated IPs, user agents, or artificially recorded conversions—can be used to commit click-fraud or inflate affiliate metrics. The runtime instructions do not tell the agent to read unrelated system files, but they do instruct saving/exporting reports to local paths (exportReport) which the code currently simulates rather than performing safe validated file writes. Also, SKILL.md expects API keys to be supplied at runtime but the skill metadata declares no required environment variables — a mild mismatch in how secrets are provided.
✓ 安装机制
There is no automated install spec in the skill bundle (instruction-only install guidance + included package.json), so nothing arbitrary will be downloaded by the platform during install. The code uses standard npm dependencies (axios, cheerio, node-fetch) which are typical and traceable via npm. No remote URL-based installers or extracted archives were specified in the skill manifest (lower install risk).
ℹ 凭证需求
The skill does require affiliate platform credentials in practice (Amazon Associates, ShareASale, CJ, etc.) but does not declare any required environment variables in the manifest; instead it expects the operator to pass API keys into configure() at runtime. That is reasonable functionally, but users should be aware the skill will handle those secrets at runtime. No other unrelated credentials or system config paths are requested. Because secrets are accepted at runtime, the operator should avoid providing high-privilege keys or account credentials with unnecessary write permissions.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills' configurations. Model invocation is allowed (default), which is normal. There is no evidence the skill attempts to persist itself into system-wide agent settings; automation tasks are created internally in-memory and reported back. No elevated platform privileges are requested in the manifest.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/15
- Added RELEASE.md for release notes and SUMMARY.md for documentation overview - Updated package.json and clawhub.json metadata - No changes to skill functionality or interface - Improves project documentation and organizational clarity
● 无害
安装命令 点击复制
官方npx clawhub@latest install affiliate-marketing-auto
镜像加速npx clawhub@latest install affiliate-marketing-auto --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制