📦 WooClaw Lite — WooCommerce 连接器
v1.0.1WordPress/WooCommerce 连接器 Lite 版工具。
1· 2.3k·3 当前·3 累计
by 下载技能包
最后更新
2026/2/27
安全扫描
OpenClaw
可疑
high confidenceThe skill appears to implement exactly the WooCommerce connector it claims to be, but metadata and packaging inconsistencies (declared requirements vs. actual code/README) raise concerns that should be resolved before trusting it with your store secret.
评估建议
Before installing: 1) Resolve the metadata mismatch — confirm with the publisher why the registry lists no required env vars while SKILL.md and the code require OPENCLAW_STORE_URL and OPENCLAW_STORE_SECRET. 2) Only provide your Store Secret to this skill if you trust the OpenClaw Connector Lite plugin installed on your WordPress site — that secret grants API access to your store endpoints. 3) Review the WordPress plugin code and the plugin's endpoint (/wp-json/openclaw/v1/*) on your site to ensu...详细分析 ▾
⚠ 用途与能力
The code and SKILL.md clearly implement a WooCommerce/OpenClaw connector and legitimately require the store URL and a store secret. However, the registry metadata claims no required environment variables or primary credential while SKILL.md and scripts/index.js require OPENCLAW_STORE_URL and OPENCLAW_STORE_SECRET. This metadata mismatch is an incoherence that should be fixed or explained.
✓ 指令范围
The SKILL.md and exported tools limit behavior to fetching orders/products and checking store status. Instructions and code do not attempt to read local files or unrelated environment variables; network calls are targeted at the store's wp-json/openclaw endpoints and requests are HMAC-signed with the provided secret.
ℹ 安装机制
There is no explicit install spec in the registry (instruction-only), but package.json and README instruct running npm install to fetch axios. This is a normal npm dependency (axios) and there are no downloads from arbitrary URLs or extract steps. The lack of an install spec in the registry is an operational inconsistency to be aware of.
⚠ 凭证需求
The environment access the code actually needs (OPENCLAW_STORE_URL and OPENCLAW_STORE_SECRET) is proportionate to the stated purpose. However, the registry metadata omits these required env vars entirely — a mismatch that could mislead users into installing without providing needed secrets or understanding what will be accessed.
✓ 持久化与权限
The skill is user-invocable, not marked always:true, and does not modify other skills or system-wide settings. It does not request elevated persistence or cross-skill configuration changes.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/2/1
- Renamed the skill from "wooclaw-connector" to "openclaw-connector." - Updated description and documentation to reference the "OpenClaw Connector Lite" plugin instead of "WooClaw Connector." - Changed required environment variable names from WOOCLAW_* to OPENCLAW_*.
● 无害
安装命令
点击复制官方npx clawhub@latest install wooclaw-lite
镜像加速npx clawhub@latest install wooclaw-lite --registry https://cn.longxiaskill.com