📦 ShipHero — 电商仓储管理
v1.0.1连接 ShipHero WMS，一键同步订单、库存与发货数据，自动分配仓库、生成面单并回传物流信息，实时追踪包裹状态，支持批量拣货波次与退货处理，让电商履约流程零人工干预。
0· 69·0 当前·0 累计
by 下载技能包
最后更新
2026/4/7
安全扫描
OpenClaw
安全
high confidenceThe skill's instructions and requirements are consistent with a ShipHero integration that uses the Membrane CLI as a proxy; the main risk is trusting the third‑party Membrane service and installing a global npm CLI as instructed.
评估建议
This skill appears internally consistent: it asks you to install and use the Membrane CLI to connect and proxy ShipHero calls. Before installing, consider the following: 1) You must trust Membrane (getmembrane.com) because it will store tokens and proxy API requests — review their privacy/security docs and terms. 2) Instead of 'npm install -g', prefer 'npx @membranehq/cli' or a local install to avoid global system changes. 3) Verify the npm package maintainer and package integrity (package name,...详细分析 ▾
✓ 用途与能力
The name/description (ShipHero integration) match the SKILL.md: all runtime steps are about installing and using the Membrane CLI to connect to ShipHero, list actions, run actions, or proxy raw requests. No unrelated credentials, binaries, or config paths are requested.
ℹ 指令范围
Instructions stay within the stated purpose (installing membrane CLI, logging in, creating/using a ShipHero connection, running actions, or proxying requests). They do not instruct reading arbitrary local files or environment variables. Important to note: the skill relies on Membrane to hold credentials and proxy API traffic, so using it means the Membrane service will see proxied requests and hold auth tokens.
ℹ 安装机制
There is no registry install spec, but SKILL.md tells users to run 'npm install -g @membranehq/cli' (and suggests npx usage). Installing a global npm CLI is a common approach but carries moderate risk: it writes to the system and executes third‑party code from the npm registry. Verify the package and prefer npx or scoped/local installs if you want lower footprint.
✓ 凭证需求
The skill does not request environment variables, local config paths, or secrets. However, it requires a Membrane account and browser‑based login; credentials and tokens are managed server‑side by Membrane. This is proportionate to the skill's design but implies trusting a third party with API credentials and proxied request content.
✓ 持久化与权限
The skill is not force-included (always: false) and does not request elevated platform privileges. The only persistent change the instructions suggest is installing a CLI tool locally (npm global install), which is normal for CLI-based integrations.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/4/7
Auto sync from membranedev/application-skills
● 无害
安装命令
点击复制官方npx clawhub@latest install shiphero
镜像加速npx clawhub@latest install shiphero --registry https://cn.longxiaskill.com