by 安全扫描
OpenClaw
安全
medium confidenceThe skill is internally coherent with its stated purpose (instruction-only A/B testing guidance) and doesn't request credentials, but it includes an external install hint and some platform-level assumptions you should verify before use.
评估建议
This appears to be a guidance-only skill and does not itself request secrets, but take care before following the install hint. If you run `npx skills add nexscope/ecommerce-ab-testing` you will download and execute third-party code—review the package source (npm registry page or repository) and verify the publisher. Be aware that if you ask the skill for step-by-step platform integrations (Shopify, Amazon, Meta, Google Ads, TikTok), you will need to supply credentials to those platforms; never p...详细分析 ▾
✓ 用途与能力
Name/description match the SKILL.md content: methodology, platform-specific guidance (Amazon, Shopify, Meta, Google, TikTok), test prioritization, and sample-size calculations. The skill is advisory in nature and doesn't claim to perform actions that would require extra privileges.
✓ 指令范围
The SKILL.md contains only guidance and example prompts; it does not instruct the agent to read local files, access environment variables, or transmit data to unexpected endpoints. It stays within the advisory/consulting scope for A/B testing.
ℹ 安装机制
Registry shows no install spec (instruction-only), but SKILL.md includes an 'Install' snippet: `npx skills add nexscope/ecommerce-ab-testing`. That line encourages fetching and running external code from npm via npx. This is a user action (not automatic), but running it would download third-party code—verify the package source before executing.
ℹ 凭证需求
No environment variables, credentials, or config paths are declared or required by the skill, which is reasonable for an advisory skill. However, many of the platform-specific operations it describes (Shopify, Amazon, ad platforms) typically require credentials if the user later asks for operational steps — the skill doesn't declare or explain that requirement.
✓ 持久化与权限
No code files, no install-time persistence, and 'always' is false. The skill does not request elevated or persistent privileges in the registry metadata.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install ecommerce-ab-testing
镜像加速npx clawhub@latest install ecommerce-ab-testing --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
E-Commerce A/B Testing — 实用工具 安装说明： 安装命令：["openclaw skills install ecommerce-ab-testing","npx clawhub@latest install ecommerce-ab-testing"]