by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code matches its stated purpose (fetching B站 Top20) but the package metadata omits required runtimes/dependencies and has no install steps — this mismatch is unexpected and worth review before installing.
评估建议
This skill appears to do what it says (call Bilibili's ranking API and print top 20 entries), but the manifest omits runtime requirements. Before installing or enabling it: 1) Verify you are willing to run bundled code from this unknown source. 2) Ensure your agent environment has Node.js and a Python interpreter available, and install the Python 'requests' package (pip install requests) or update the skill to declare/install that dependency. 3) Consider running the code in a sandbox or review/m...详细分析 ▾
⚠ 用途与能力
The skill name/description and included code (index.js + bili_fetcher.py) are coherent: they fetch B站 Top20 via the official Bilibili API and extract title/summary/link. However the registry metadata lists no required binaries or environment variables even though the implementation requires a Node.js runtime (to register the tool) and a Python runtime with the 'requests' library. That omission is a meaningful inconsistency.
✓ 指令范围
SKILL.md instructs the agent to dispatch a local tool (bili_fetch_tool). The tool's implementation only runs a local Python script and issues an HTTPS GET to api.bilibili.com. The instructions do not read arbitrary files, request unrelated environment variables, or post data to unknown external endpoints.
⚠ 安装机制
There is no install spec despite included code that must run. The skill will require Node.js and Python on PATH and the Python 'requests' package installed; none of this is declared or installed automatically. Missing install steps increase the chance of runtime failure or ad-hoc manual fixes that a user might do incorrectly.
✓ 凭证需求
The skill declares no environment variables or credentials and the code does not attempt to read secrets or other environment values. Network access is limited to the Bilibili public API endpoint, which is proportional to the stated purpose.
✓ 持久化与权限
The skill is not forced always-on (always: false) and does not request elevated privileges or attempt to modify other skills or system-wide configuration. It runs on-demand as a tool via exec; autonomous invocation defaults apply but are not an additional red flag here.
⚠ index.js:16
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/3/24
- Migrated to OpenClaw standard Tool plugin architecture. - Introduced direct command dispatch, bypassing model inference. - Now uses Node.js Bridge to invoke the Python automation script. - Marked as user-invocable for direct use.
● Pending
安装命令 点击复制
官方npx clawhub@latest install bili-trending
镜像加速npx clawhub@latest install bili-trending --registry https://cn.clawhub-mirror.com
技能文档
# 技能介绍 这是一个遵循 OpenClaw 标准 Tool 插件架构的 B 站热榜抓取模块，底层通过 Node.js Bridge 唤起 Python 自动化脚本
更新日志 (v1.2.0)
- 修复了Windows环境下终端输出特殊字符（如Emoji）导致的GBK编码报错问题，强制采用UTF-8输出。遵循了openclaw3.23.2版本规范进行了修改
- 遵循了openclaw3.23.2版本规范进行了修改
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制