Skills/ClawHub/sycm-shop-report

sycm-shop-report@1.0.2

VERIFIED

Publisher claims: "Generate illustrated (chart-rich) Simplified-Chinese .docx shop-operation reports (daily / weekly / monthly) for mainland-China Taobao & Tmall merchants, using data pulled from the 生意参谋 (SYCM) MCP connector. Each invocation must specify a shop name, a report period, and the merchant's own connected 生意参谋 account; the skill does not run on guessed context. Outputs Chinese text and defaults to Asia/Shanghai timezone because the underlying data source (生意参谋 / 千牛 / 万相台) is a mainland-China merchant console. Use ONLY when a merchant explicitly asks for a 日报 / 周报 / 月报 or 经营分析 based on 生意参谋 store data. Do NOT use for generic "make me a report" requests, non-e-commerce analytics, or stores outside the Taobao/Tmall ecosystem." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher gzbarry1980-bot · joined 5 days agoInstalls 189Last detonated 5d ago
$clawhub install sycm-shop-report
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionSKILL.md:79 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_weekly_report.js:3 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_weekly_charts.py:10 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_daily_charts.py:10 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_daily_report.js:3 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_weekly_charts.py:5 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/build_daily_charts.py:5 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
sycm-shop-report@1.0.2 safety verdict: Verified 88/100 — KillerSkills