The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs users to extract and provide full session cookies from jd.com and taobao.com. These cookies typically contain sensitive session identifiers (e.g., sid, token, uid) that grant full access to the user's e-commerce accounts, including personal information, order history, and potentially payment methods.
Evidence in SKILL.md: The 'Cookie Extraction Guides' provide a JavaScript snippet for jd.com that captures document.cookie and prompts the user to 'Paste the copied JSON here to save securely'.
Evidence in smart_shopping.py: The save_cookie method stores these raw authentication tokens in a local file ~/.openclaw/.cookies/{platform}_cookie.json. While it mentions encryption in comments, the implementation shown uses standard json.dump to write the data in plain text.

smart-shopping