Content Analytics — 技能工具
v1.0.0分析掘金、小红书、知乎多平台内容表现数据，提供汇总对比和基于AI的优化建议。
0· 800·3 当前·3 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (multi‑platform content analytics) is plausible, but the instructions and metadata are incomplete and inconsistent about how it will access data (cookies vs APIs), what runtime components (Playwright, GLM‑5) are required, and how sensitive credentials are handled.
评估建议
This skill could be useful, but it is underspecified and requests sensitive cookies without telling you how they will be used or stored. Before installing or providing credentials: 1) Ask the author to clarify whether official APIs or web scraping (Playwright) will be used for each platform and to provide a privacy/handling policy for cookies; 2) Prefer OAuth or API tokens scoped to read‑only creator data rather than raw session cookies; 3) Ask how GLM‑5 is hosted and whether any API keys or dat...详细分析 ▾
ℹ 用途与能力
The name/description (analyze Juejin, Xiaohongshu, Zhihu content) matches the SKILL.md functionality. Requesting cookies for Juejin and Xiaohongshu is consistent with scraping/creator‑center access. However, Zhihu is listed as a data source but no cookie/config example is provided. The tech stack calls out Playwright and GLM‑5 though no install or runtime requirements are declared, which is an omission.
ℹ 指令范围
SKILL.md tells the agent to analyze and compare platform data and shows optional JSON cookie configs for two platforms. It does not instruct reading unrelated system files or environment variables. But it is vague about the exact data‑fetch method (official APIs vs web scraping), error handling, and where analysis/modeling happens — leaving the agent broad discretion to use Playwright to scrape pages, which has higher privacy/risk implications.
⚠ 安装机制
There is no install spec (instruction‑only), which is low risk by itself, but the documented tech stack names Playwright (a browser automation tool) and GLM‑5 (an LLM). Mentioning Playwright implies downloading/ running headless browsers and possibly persisting session files/cookies; the skill provides no guidance or install steps for these components. This mismatch (expectation of heavy runtime dependencies without install instructions) is a practical and security concern.
⚠ 凭证需求
The skill does not declare any required environment variables, yet it expects sensitive credentials (platform cookies) passed in JSON config examples. Cookies are high‑value secrets that expose account access; the skill offers no guidance on storage, scoping, or using official OAuth tokens instead. Also, Zhihu is a declared data source but there is no example credential/config for it, which is inconsistent.
✓ 持久化与权限
The skill is not always‑on, does not request system config paths, and is instruction‑only. It does not declare persistence or system‑wide changes. There is no explicit request to modify other skills or store agent‑wide tokens.
安装前注意事项
- Ask the author to clarify whether official APIs or web scraping (Playwright) will be used for each platform and to provide a privacy/handling policy for cookies;
- Prefer OAuth or API tokens scoped to read‑only creator data rather than raw session cookies;
- Ask how GLM‑5 is hosted and whether any API keys or data leave your environment;
- Avoid pasting account cookies into public or shared agents — treat them as high‑risk secrets;
- If Playwright or a headless browser will be run, only allow it in a controlled environment since it can persist session files. If the author cannot clarify these points (especially where Zhihu creds belong and how secrets are stored/transmitted), consider the skill suspicious and avoid supplying credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/11
Initial release
● 可疑
安装命令 点击复制
官方npx clawhub@latest install content-analytics
镜像加速npx clawhub@latest install content-analytics --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制