📦 1688-product-search — 1688商品搜索
v1.0.3集成1689官方API，一站式提供类目、关键词、图片搜索及商品详情、关联推荐、货盘底池等9大接口，支持多语言与全局Token缓存，快速获取商品数据。
1· 432·0 当前·0 累计
by 下载技能包
最后更新
2026/3/23
安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears to implement the 1688 product-search functionality it claims and only needs 1688 credentials. Before installing: 1) Verify you are comfortable providing ALI1688_APP_KEY/ALI1688_APP_SECRET and a refresh token to the environment (these are necessary). 2) Note the skill writes a token cache to your home directory (~/.openclaw/workspace/skills/.1688_token_cache.json) — confirm you accept a shared cache file and its location; SKILL.md and the code disagree on the cache path. 3) The...详细分析 ▾
✓ 用途与能力
Name/description, SKILL.md, and the included Python scripts all implement 1688 product search, image search, and related endpoints and require 1688 API credentials (AppKey/AppSecret/refresh_token). No unrelated cloud providers or unrelated credentials are requested.
ℹ 指令范围
Runtime instructions and scripts perform expected actions: read 1688 credentials from environment, call 1688 APIs, download user-supplied image URLs, compress images, upload them to 1688, and write temporary files. These behaviors are consistent with the stated purpose, but the skill will download arbitrary image URLs (from user input) and write temp files and a token cache to disk — the documentation suggests a different token cache path than the code actually uses.
✓ 安装机制
This is instruction-and-code-only with no install spec. No external/opaque download/install steps are present in the manifest, so nothing is fetched from untrusted URLs at install time.
✓ 凭证需求
The skill requires ALI1688_APP_KEY, ALI1688_APP_SECRET, and ALI1688_REFRESH_TOKEN (and optionally accepts ALI1688_ACCESS_TOKEN). These credentials are appropriate and expected for calling the 1688 API; no unrelated secrets are requested. Note: the registry summary earlier claimed 'no required env vars', which contradicts SKILL.md.
ℹ 持久化与权限
The skill writes a shared token cache file to the user's home path: PATH = ~/.openclaw/workspace/skills/.1688_token_cache.json (as implemented in the auth modules). SKILL.md mentions a different relative path (skills/.1688_token_cache.json). The skill is not marked 'always: true' and does not modify other skills, but the shared cache file means multiple 1688-related skills will reuse the same token storage — consider whether that sharing and the home-directory write are acceptable.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/3/23
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install 1688-product-search
镜像加速npx clawhub@latest install 1688-product-search --registry https://cn.longxiaskill.com