1688-shopkeeper
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The entry script
cli.pyuses dynamic module loading to dispatch sub-commands. This implementation is secure as it uses a whitelist approach. - Evidence: The script validates the user-supplied command against the
COMMANDSdictionary before passing the mapped module name toimportlib.import_module(). - [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data and publish products.
- Evidence: Network requests are directed to
ainext.1688.com, which is the official service domain for the 1688 platform. - [SAFE]: The skill implements standard credential management practices.
- Evidence: The
configure.pyscript saves the user-providedALI_1688_AKto the local agent configuration file (~/.openclaw/openclaw.json) or updates it via a local Gateway API, ensuring persistence without external exfiltration.
Audit Metadata