1688-product-analysis@1.0.0
VERIFIED· install onlyPublisher claims: "1688 商品全方位分析诊断工具，整合多数据源对指定商品进行深度分析，支持多店铺异常商品汇总、评分分层选品与单品诊断。 覆盖能力：商品数据分析、销售表现诊断、流量问题排查、广告效果评估、商品优化建议、多店铺异常商品汇总、重点品评分分层、关键词搜索商品。 适用场景：用户需要分析商品表现、诊断流量问题、查看多店铺异常商品、圈选重点运营商品、搜索店铺商品、获取商品优化建议时使用。 触发词：分析这个商品、商品诊断、商品表现分析、为什么商品没流量、商品优化建议、最该优化的商品、最应该优化的商品、商品数据分析、多店铺商品、重点品查看、圈选重点品、圈选运营商品、今日运营重点、选品、推荐商品、商品分层、商品优先级、搜索商品、新品没流量怎么办、导出商品体检报告、导出当前已生成的报告、输出商品体检报告 Markdown、在当前对话输出商品体检报告。 本 Skill 的核心流程已由 workflow `1688-product-analysis` 编排覆盖，包含明确商品 ID 诊断、异常商品选择、找问题品并诊断、关键词搜索、正向选品、同款商品分析、商品库推荐行动点与一键优化交接；单接口查询、自由组合或探索性分析回退加载本 SKILL.md。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
环境变量（从项目根目录 .env 读取）：Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.## 环境变量（.env）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.`del /f /q "${outFile}" "${errFile}"`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.项目根目录的 `.env` 文件存储 skill 基础信息，供埋点上报等模块读取。发布到不同环境时可直接替换该文件中的变量值。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose."""解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.> 已存在的系统环境变量优先级高于 `.env`，CI/CD 注入的变量不会被覆盖。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.env_path = _ROOT_DIR / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.# 模块加载时解析一次 .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.command = `${program} -c "import base64;open(r'${wrapFile}','wb').write(base64.b64decode('${toBase64(utf8Bytes(wrapper))}'))" & call "${wrapFile}" & del /f /q "${wrapFile}"`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.