安全扫描
OpenClaw
可疑
medium confidenceThe skill's purpose (crawl Aliyun Model Studio and regenerate derived skills) matches the included scripts, but there are inconsistent runtime assumptions (npx usage not declared, path mismatches) and it instructs executing an npm package via npx which carries moderate risk.
评估建议
This skill appears to do what it says (crawl the Aliyun Model Studio page and generate summaries and suggested skills), but review a few things before running it:
- Path mismatch: SKILL.md runs scripts at skills/ai/misc/.../scripts/*.py but the repository has scripts/refresh_*.py at top-level scripts/. Confirm the expected location or adjust commands to point to the included files; otherwise the workflow may fail or the scripts may compute wrong ROOT paths.
- npx risk: The workflow uses `npx -y...详细分析 ▾
ℹ 用途与能力
The name/description match the included Python scripts which parse a crawl and produce summaries and skill suggestions. However, SKILL.md lists Node.js/npx as a prerequisite while the skill metadata declares no required binaries; the SKILL.md command paths reference scripts under skills/ai/misc/... but the shipped files live at scripts/*.py. These mismatches mean the runtime layout the instructions expect may not match how the skill is installed or executed.
⚠ 指令范围
Instructions tell the agent to run an npx command that downloads and executes @just-every/crawl against https://help.aliyun.com and then run bundled Python scripts that read/write files. The crawling step contacts an external site (expected) but uses npx which will fetch and execute code from npm (arbitrary code execution). The SKILL.md also asks to save evidence including 'region/resource id/time range' which could encourage including environment-specific identifiers in outputs; while not secrets by name, this increases what gets written to disk and possibly shared.
ℹ 安装机制
There is no install spec (instruction-only), which reduces installer risk. However, the workflow relies on npx -y @just-every/crawl (transiently pulling an npm package and executing it). Relying on npx to run a remote package is a moderate install/execution risk unless the package and version are audited or pinned. The Python scripts are local and simple text processing (no external downloads).
✓ 凭证需求
The skill declares no required environment variables or credentials, and the Python scripts do not read secrets or env vars. The only external access is network to the public help.aliyun.com site. Asking to record 'region/resource id/time range' in evidence is informational and not a request for secrets.
✓ 持久化与权限
always is false and the skill does not request persistent or system-wide privileges. It writes outputs into an output/ subdirectory and generated skills under skills/ai/** per instructions — this is expected for a content-generation workflow and not an escalation of privilege.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/1
- Initial release of aliyun-modelstudio-crawl-and-skill. - Automates crawling of Alibaba Cloud Model Studio models and regeneration of skills in `skills/ai/**`. - Outputs structured model lists, cleaned summaries, skill coverage reports, and generated skills. - Includes validation scripts and reproducibility guidelines. - Supports updating documentation files if the skills list changes.
● 无害
安装命令 点击复制
官方npx clawhub@latest install aliyun-modelstudio-crawl-and-skill
镜像加速npx clawhub@latest install aliyun-modelstudio-crawl-and-skill --registry https://cn.clawhub-mirror.com
技能文档
Category: task
# Alibaba Cloud Model Studio Crawl and Skill Generation
Prerequisites
- Node.js (for
npx) - Python 3
- Network access to the models page
Workflow
1) Crawl models page (raw markdown)
npx -y @just-every/crawl \"https://help.aliyun.com/zh/model-studio/models\" > alicloud-model-studio-models.md
2) Rebuild summary (models + API/usage links)
python3 skills/ai/misc/aliyun-modelstudio-crawl-and-skill/scripts/refresh_models_summary.py
3) Regenerate skills (creates/updates skills/ai/)
python3 skills/ai/misc/aliyun-modelstudio-crawl-and-skill/scripts/refresh_alicloud_skills.py
Outputs
alicloud-model-studio-models.md: raw crawl outputoutput/alicloud-model-studio-models-summary.md: cleaned summaryoutput/alicloud-model-studio-models.json: structured model listoutput/alicloud-model-studio-skill-scan.md: skill coverage reportskills/ai/: generated skills
Notes
- Do not invent model IDs or API endpoints; only use links present on the models page.
- After regeneration, update
README.md,README.en.md, andREADME.zh-TW.mdif skills list changed.
Validation
mkdir -p output/aliyun-modelstudio-crawl-and-skill
for f in skills/ai/misc/aliyun-modelstudio-crawl-and-skill/scripts/*.py; do
python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/aliyun-modelstudio-crawl-and-skill/validate.txt
Pass criteria: command exits 0 and output/aliyun-modelstudio-crawl-and-skill/validate.txt is generated.
Output And Evidence
- Save artifacts, command outputs, and API response summaries under
output/aliyun-modelstudio-crawl-and-skill/. - Include key parameters (region/resource id/time range) in evidence files for reproducibility.
References
- Source list:
references/sources.md
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制