📦 Dropshipping Product Launcher — 代发货产品启动器
v1.0.0代发货产品上架工具，帮助用户快速上架代发货产品到电商平台。
0· 372·1 当前·1 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
high confidenceThe code matches the stated purpose (fetch CJ product, upload images, create WooCommerce draft) but the skill silently expects and reads/writes local credential files and environment overrides that were not declared in the registry metadata — this mismatch and the skill's modification of your home files warrants caution.
评估建议
This skill appears to do what it says (fetch CJ product data and create a WooCommerce draft), but be aware of several practical and privacy/security points before installing:
- Transparency mismatch: The registry entry claims no required credentials or config paths, yet the code reads ~/cj-api.json and ~/woo-api.json (or CJ_API_PATH/WOO_API_PATH). Verify and supply only credentials for the store you control.
- Files modified: The skill will update ~/cj-api.json with refreshed access tokens and ...详细分析 ▾
ℹ 用途与能力
Overall capability aligns with the name/description: scripts fetch CJ product data, download images, upload to a WordPress/WooCommerce site, calculate margin, and create a draft product. However, the registry metadata claimed no required config paths or credentials while SKILL.md and the code require CJ and WooCommerce credential files (~/cj-api.json and ~/woo-api.json) or the equivalent env vars (CJ_API_PATH, WOO_API_PATH). That mismatch reduces transparency and is unexpected.
⚠ 指令范围
Runtime instructions and code read credential JSON files from the user's home directory and will write back an access token to ~/cj-api.json (cj-fetch.js updates tokenExpiry/accessToken). The skill also downloads images into /tmp/product-images/<product_id>/ and uploads them to the configured WooCommerce site, creates categories, and writes products/variations via the Woo REST API. These I/O actions are consistent with the stated purpose but are potentially impactful (modifies files in your home dir and remote store). The SKILL.md did document the files, but the registry metadata did not — a scope/transparency issue.
✓ 安装机制
This is an instruction+code skill with normal npm dependencies (axios, form-data). There is no remote archive download or obscure install host. package-lock.json is present and dependencies resolve from the public npm registry; installing via npm is the expected way and proportional to the task.
⚠ 凭证需求
The skill requires sensitive credentials (CJ API keys and WooCommerce consumerKey/consumerSecret) supplied via files (~/cj-api.json, ~/woo-api.json) or override env vars (CJ_API_PATH, WOO_API_PATH). The registry metadata listed no required env vars/config paths, which is inconsistent and misleading. config/internal.md also references an 'Active store: tech1mart.com' (default base URL), suggesting the repo may be preconfigured for a specific store — verify that your credentials and URLs are pointed to the store you intend. The skill will store refreshed access tokens back to ~/cj-api.json (credential file modification).
✓ 持久化与权限
The skill does not request permanent platform presence (always: false) and does not modify other skills or system-wide agent settings. Its only persistent effect on the host is writing/updating the CJ credential file (token refresh) and writing temporary image files to /tmp; these are within the skill's functional scope but should be noted.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/2
Initial release: Launch CJ Dropshipping products as WooCommerce draft listings in one command. - Fetches product and variant data from CJ Dropshipping APIs - Downloads and uploads product images to your WordPress media library - Calculates profit margin and warns if margin is below 30% - Creates WooCommerce draft products (with variants if available) and outputs relevant URLs - Supports preview mode (dry-run) and custom categories - Outputs a structured JSON summary for downstream automation
● 可疑
安装命令
点击复制官方npx clawhub@latest install skill-dropshipping-product-launcher
镜像加速npx clawhub@latest install skill-dropshipping-product-launcher --registry https://cn.longxiaskill.com