📦 WooCommerce Stock Monitor — WooCommerce 库存监控
v1.0.1WooCommerce 库存监控工具。
0· 415·3 当前·3 累计
by 下载技能包
最后更新
2026/3/20
安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (poll WooCommerce, track instock→outofstock transitions, and send Telegram alerts); only minor metadata and configuration issues should be reviewed before use.
评估建议
This skill appears to be what it says: a simple WooCommerce poller that sends Telegram alerts. Before installing/run it, verify these points:
- The skill requires TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID (set in cron or environment). Keep the bot token secret.
- Provide a secure woo-api.json with only the WooCommerce read credentials. The default path is ~/woo-api.json; consider placing it in a restricted directory and referencing it explicitly via WOO_API_PATH.
- The script writes state to memor...详细分析 ▾
ℹ 用途与能力
Name/description, README, SKILL.md, and the included script all align: the script fetches products from the WooCommerce REST API (using consumer_key/consumer_secret from a local JSON), compares state, saves a state file, and posts alerts to Telegram. Minor inconsistency: registry metadata declares no required env vars/credentials while SKILL.md and the script require TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID and a WOO_API_PATH file; this is likely an oversight but worth noting.
✓ 指令范围
SKILL.md instructs to run node scripts/stock-monitor.js and documents environment vars and state file location. The runtime instructions and the script stay within the stated purpose: they read a specified WooCommerce credentials file, call the store API, write a local state file, and call Telegram's API. The script does not access unrelated system files or external endpoints beyond the store and api.telegram.org.
✓ 安装机制
No install spec (instruction-only) and the script is bundled with the skill; there are no downloads or external installers. This is low-risk from an install perspective.
ℹ 凭证需求
The script legitimately needs a WooCommerce API (consumer key/secret via woo-api.json) and Telegram bot token/chat id. Those are proportionate to the feature. However, registry metadata did not declare these required credentials — the omission could mislead users about what secrets are needed. The default WOO_API_PATH points to the user's home directory, so users should ensure the referenced JSON is stored securely.
✓ 持久化与权限
The skill is not always-enabled and may be invoked by the agent; it writes a local state file memory/stock-state.json under the skill's directory (normal for tracking state). It does not modify other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/2
- Added README.md with usage instructions, configuration details, and setup guidance. - No changes to functionality.
● 无害
安装命令
点击复制官方npx clawhub@latest install skill-woocommerce-stock-monitor
镜像加速npx clawhub@latest install skill-woocommerce-stock-monitor --registry https://cn.longxiaskill.com