skills/wulaosiji/skills/smart-shopping/Socket

smart-shopping

Warn

Audited by Socket on Apr 18, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill’s shopping purpose is plausible, but its core mechanism is collecting raw JD/Taobao session cookies via DevTools and sending them to the assistant. That is a disproportionate credential-handling pattern with meaningful account-takeover risk if stored or reused improperly, even though no malicious installer or obvious third-party exfiltration endpoint is shown.

Confidence: 89%Severity: 72%

Audit Metadata

Analyzed At

Apr 18, 2026, 01:14 AM

Package URL

pkg:socket/skills-sh/wulaosiji%2Fskills%2Fsmart-shopping%2F@a9cfbc5ee5b867d4a9c205b1839ecd3fbb3d7e79