1688-shopkeeper

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The entry script cli.py uses dynamic module loading to dispatch sub-commands. This implementation is secure as it uses a whitelist approach.
  • Evidence: The script validates the user-supplied command against the COMMANDS dictionary before passing the mapped module name to importlib.import_module().
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data and publish products.
  • Evidence: Network requests are directed to ainext.1688.com, which is the official service domain for the 1688 platform.
  • [SAFE]: The skill implements standard credential management practices.
  • Evidence: The configure.py script saves the user-provided ALI_1688_AK to the local agent configuration file (~/.openclaw/openclaw.json) or updates it via a local Gateway API, ensuring persistence without external exfiltration.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 10:30 PM