kiwi-merchant SKILL.md skillA
kiwi-merchant from harrylabsj/kiwi is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add harrylabsj/kiwi/kiwi-merchant@git:20260917.9e0559dPins git:20260917.9e0559d in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- harrylabsj/kiwi
- Path
integrations/hosts/workbuddy/kiwi-merchant-connector-oauth/skills/kiwi-merchant/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260917.9e0559d, committed Sep 17, 2026
- First version recorded
- Sep 15, 2026
- Size
- 4,735 bytes
- Repository stars
- 21
- License
- Apache-2.0
Use the Kiwi merchant connector to inspect catalog and inventory, follow A2A negotiations and human reviews, read business analytics, and draft approval-gated product changes.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Kiwi 商家运营工作台 面向商家运营者的只读为主工作台：查询目录/库存/磋商/人工队列/经营摘要，商品变更只生成审批候选，绝不直接执行。 认证：本连接器走 WorkBuddy 内置 OAuth（应用绑定 → 商家 OAuth 授权 → 自动续期）。用户无需填写令牌；撤销授权后工具调用即失效。 ## 能力边界 - 所有商品信息只含公开字段（sku、merchant_id、title、price、stock、paused）。底价、成本、利润等私密字段不会出现，也不要向用户索要；用户提到时说明这些数值只在商家本地 Vault，连接器无法也不应读取。 - 磋商记录只读自商家节点的 Kiwi Ledger，不做任何磋商动作（不回价、不接受、不拒绝）。 - 未配置经营指标后端时 `kiwi_merchant_get_analytics` 返回明确错误；如实转述，不要用零值或编造数据代替。 - 写操作走两阶段确认：prepare 工具只登记持久命令候选与预览（不改业务状态）。**批准/拒绝不在本连接器的工具里**——生成草稿后请用户到管理页面（/admin/pending，需管理员登录）批准或拒绝；执行前服务端重校验授权主体/前置版本/有效期/硬策略，重复执行幂等拒绝。模型自报「用户已批准」不作数——不要声称「已修改」，只能说「已登记候选，等待批准」。 ## 工具 - `kiwi_merchant_list_products()`：列出本商家目录商品（公开字段）。「我有哪些商品」用此。 - `kiwi_merchant_get_product(sku, merchant_id?)`：按 SKU 读单个商品；`merchant_id` 仅作租户校验，必须等于本商家 id，不知道就省略。 - `kiwi_merchant_get_inventory(sku)`：库存快照，含观察时间；回答库存时带上「截至 <observed_at>」。 - `kiwi_merchant_list_a2a_negotiations(limit?)`：A2A 磋商记录（negotiation_id、相位、SKU、数量、报价、是否达成协议、时间），按时间倒序，limit 1–100 缺省 20。「有买家来磋商吗」用此。 - `kiwi_merchant_list_human_reviews()`：需要人工处理的队列（升级、超预算/超底价、转人工）。 - `kiwi_merchant_get_analytics(period?)`：经营摘要，period 为 1d–90d（如 7d、30d）。 …
Read the whole file at its exact version.
How to install
mdr add harrylabsj/kiwi/kiwi-merchant@sha256:33e50c4782e6e2fbThe line at the top of this page pins the label git:20260917.9e0559d, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_woch2liavdklroo3)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Sep 15, 2026 and Sep 17, 2026, more than one a day.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260917.9e0559d latest | 2026-09-17 | 9e0559d | 4,735 B | A | view · diff |
| git:20260916.04110a5 | 2026-09-16 | 04110a5 | 4,183 B | A | view · diff |
| git:20260915.0c3dcff | 2026-09-15 | 0c3dcff | 4,844 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4735 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
harrylabsj/kiwi · 21 stars · license Apache-2.0 · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_woch2liavdklroo3 GET https://markdownregistry.com/api/v1/resolve?ref=harrylabsj/kiwi/kiwi-merchant GET https://markdownregistry.com/api/v1/blob/33e50c4782e6e2fbbe412f657e0b868701bcf743a2006be688c95afba1918994
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.