Skills/ClawHub/1688-shop-compete-analysis

1688-shop-compete-analysis@0.1.0

VERIFIED

Publisher claims: "1688 竞店竞品分析 Skill。基于生意参谋「竞争」数据与买家采购流失信息，对当前登录店铺做竞争分析：竞店发现（行业排行/客户流失去向/监控清单）、竞店结构下钻（核心指标对比/热销商品/成交价格带/引流搜索词/买家结构六维）、竞品（商品级）三维下钻（引流词/流量来源/买家结构七维）、买家流失商品识别与竞对对比归因。触发词：竞争分析、竞店分析、竞品分析、竞对、同行对比、对标、对手、行业排行、我的竞店是谁、客户流失到哪、买家流失、被同行抢走、同款竞品、引流词对比、价格带对比、买家画像对比。所有数据来自真实接口返回，禁止捏造；需在 Accio Desktop 环境内运行且当前商家已授权，商家身份由本地网关登录态自动注入，无需 AK / userId。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher 1688aiinfra · joined 9 days agoInstalls 333Last detonated 1 h ago
$clawhub install 1688-shop-compete-analysis
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/_http.py:96 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

No other findings across 4,258 lines in 30 files.

Cost to the agent

Instructions loaded
≈3,511 tok
1 file · 30 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.