📦 Pinduoduo Automation — 拼多多自动化
v2.0.2一站式拼多多运营助手，自动完成商品上下架、订单同步、竞品价格监控、智能定价及多维度销售数据分析，显著降低人力成本并提升店铺 GMV。
2· 761·5 当前·5 累计
by @wukaikai522下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This package appears to be an incomplete or placeholder 'Pinduoduo automation' skill rather than a working product. Before installing or providing any API keys: 1) Ask the author for the canonical source repository or release that implements the CLI and encryption/logging claims; 2) Do not paste real app_key/app_secret/access_token into the config.yaml until you confirm how they are stored/used; 3) Verify the presence of actual network/HTTP client code that talks to open.pinduoduo.com and review...详细分析 ▾
⚠ 用途与能力
The SKILL.md claims extensive capabilities (商品管理, 订单处理, 竞品监控, 智能定价, 报表/自动化), but the repository contains only two small placeholder shell scripts and a config template. There are no binaries, no implementation of the CLI commands referenced (e.g., `pinduoduo-automation daily-report`, `diagnose`, `test-connection`), and many files referenced in the file tree (product_manager.sh, order_processor.sh, data_analyzer.sh, pricing_engine.sh, README.md) are missing. The declared functionality is disproportionate to the actual artifacts included.
⚠ 指令范围
Runtime instructions tell the user to edit a config file under ~/.openclaw/workspace/skills/... and run named CLI commands, but the package contains no executable or entrypoint implementing those commands. The two provided scripts are inert placeholders that only echo TODO content and one writes a static report with zeros. The SKILL.md also asserts encryption of API keys and logging practices, but no mechanism or scripts to implement those security features are present. Instructions are therefore misleading and grant the agent wide discretion without concrete implementation.
✓ 安装机制
There is no install specification (instruction-only with a couple of small scripts). That is low-risk from an automatic install perspective because nothing is automatically downloaded or executed during install.
ℹ 凭证需求
No environment variables or credentials are required by the registry metadata, but config.yaml includes fields for app_key, app_secret, and access_token (expected for an API-integrated ecommerce tool). This is not inherently excessive, but the skill does not declare or implement secure storage or an expected method for those secrets; SKILL.md claims encrypted storage but provides no code to perform it. Also the absence of declared required env vars while a config file expects Secrets may confuse users.
✓ 持久化与权限
The skill is not always-enabled and is user-invocable (defaults). It makes no request to change other skills or system-wide settings. There is no install-time persistence mechanism in the package.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.22026/2/28
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install pinduoduo-automation
镜像加速npx clawhub@latest install pinduoduo-automation --registry https://cn.longxiaskill.com