by 安全扫描
OpenClaw
安全
high confidenceThe code, instructions, and requirements are internally consistent: the skill automates submitting meal-subsidy forms in the described HR webapp using Selenium and a Chrome remote-debugging session and does not request unrelated credentials or network endpoints.
评估建议
This skill appears to do exactly what it says: automate meal-subsidy submissions in your company's i-wework site using Selenium and a Chrome remote-debugging session. Before using it: (1) Inspect the full source yourself (the distributed scripts run locally and are editable); (2) Run Chrome with a dedicated profile (the scripts reuse a remote-debugging session and a --user-data-dir) so they don't operate on your main browser profile; (3) Understand it will save screenshots and a CSV to the skill...详细分析 ▾
✓ 用途与能力
Name/description (自动申请餐补) match the code and SKILL.md: scripts use Selenium to read attendance from https://i-wework.2haohr.com and fill/submit meal-subsidy forms. Required tools (Chrome, chromedriver, selenium) are expected for this purpose.
ℹ 指令范围
Runtime instructions are focused: start Chrome with remote debugging, log in interactively, then run the Python scripts which navigate the HR site, take screenshots, fill forms, upload screenshots, and save a local CSV. The scripts read/write only local files under the skill folder and TEMP (for user-data-dir) and interact only with the declared target URL. Note: the code uses USERPROFILE/%TEMP% paths and saves screenshots/csv locally; it also executes injected JS in the page (expected for form filling).
✓ 安装机制
No install spec in registry; SKILL.md asks the user to pip install selenium. No remote downloads or archive extraction in the skill bundle. The code may auto-start Chrome via subprocess (local binary), which is expected for Chrome-based Selenium automation.
✓ 凭证需求
The skill declares no required environment variables or credentials. The code does reference USERPROFILE and uses os.path.expandvars to find chromedriver and to set a user-data-dir under TEMP — these are reasonable local-path usages for Windows and do not imply access to unrelated secrets or external services.
✓ 持久化与权限
always is false and the skill does not request persistent platform-wide privileges. It auto-starts Chrome with a dedicated user-data-dir but does not modify other skills or agent-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/4/7
截图改为只截当天那格，不再截整页日历
● 无害
安装命令 点击复制
官方npx clawhub@latest install meal-subsidy
镜像加速npx clawhub@latest install meal-subsidy --registry https://cn.clawhub-mirror.com
技能文档
自动读取2号人事部考勤，判断下班时间是否满足餐补条件，全自动填写并提交。
申请条件
| 下班时间 | 餐补 |
|---|---|
| ≥ 20:30 | 20元 |
| 00:00 ~ 06:00（跨天） | 40元 |
| 其他 | 不申请 |
触发指令（对小特说）
| 指令 | 效果 |
|---|---|
| "申请餐补" | 查昨天，满足则申请 |
| "申请4月7日餐补" | 查指定日期（默认当年，如2026年4月7日） |
| "申请4月餐补" | 查整个4月（默认当年），批量申请所有满足条件的日期 |
| "本周餐补" | 批量申请本周所有满足条件的日期 |
快速开始（3步）
第一步：安装依赖
pip install selenium
第二步：启动 Chrome 远程调试（只需一次）
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222
Mac：/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222打开后扫码登录 https://i-wework.2haohr.com/desk/home，之后运行无需重复登录。
如果报错 "cannot connect to chrome"，先执行此步骤
第三步：运行脚本
# 申请指定日期（默认昨天）
python meal_subsidy.py --date 2026-04-07# 申请整月（批量）
python meal_month.py 2026 4
截图说明
| 文件 | 内容 |
|---|---|
screenshots/attendance_YYYYMMDD.png | 考勤截图（上传用） |
screenshots/meal_form.png | 餐补表单截图 |
screenshots/meal_before_submit.png | 提交前确认 |
screenshots/after_submit.png | 提交后截图 |
screenshots/attendance_late_YYYYMM.csv | 申请记录表 |
依赖
| 依赖 | 说明 |
|---|---|
| Python 3.8+ | 语言环境 |
| selenium | pip install selenium |
| Chrome 浏览器 | 系统已安装即可 |
| ChromeDriver | 自动查找，无需手动安装 |
常见问题
Q: 报错 "cannot connect to chrome at 127.0.0.1:9222" A: Chrome 没有以远程调试模式启动。按第二步重新启动 Chrome。
Q: 提示 "登录超时" A: 需要先在 Chrome 里手动扫码登录一次（只需一次）。
Q: 提交流程正常但上传的截图不对 A: 请确保 Chrome 打开了考勤页面（显示日期和下班时间），再运行脚本。
技术说明
- iView picker 填写：直接 send_keys 无效，必须用 JS 原生 setter 触发 Vue 响应式
- Chrome 复用：自动连接端口 9222，已登录状态不丢失
- iframe 处理：餐补表单在 iframe 内，JS 直接跨帧操作
.ivu-date-picker - 自动启动：端口 9222 不可用时，脚本会自动启动新的带调试端口的 Chrome
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制