by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (fast extraction from modern web frameworks) is plausible, but there are multiple inconsistencies and dual‑use behaviors (Cloudflare/WAF bypass, missing install spec, conflicting repo URLs, and an opaque 'install-mcp' step) that warrant caution before installing or running the binary.
评估建议
This skill could be what it claims (fast scraping of framework-embedded JSON), but several things don't add up and raise real risk:
- Inconsistent sources: SKILL.md points to https://github.com/sirToby99/swipenode while README uses https://github.com/Nefas11/swipenode — confirm the official source and verify repository history before cloning or building.
- No formal install spec: the registry lists no installer, yet instructions ask you to git clone and go build a binary from an external repo. ...详细分析 ▾
⚠ 用途与能力
The skill claims to be a local CLI that extracts framework-embedded JSON and to perform TLS/TLS-fingerprint spoofing to bypass WAFs. Extracting __NEXT_DATA__ / window.__NUXT__ etc. matches the stated purpose, but the WAF/TLS-spoofing claim is a powerful dual-use capability that is out-of-band for a simple 'extractor' and increases misuse risk. Additionally, the registry metadata declares no install and no binaries required, yet the SKILL.md expects a local binary path and gives build/run commands — an inconsistency.
⚠ 指令范围
Runtime instructions tell the agent (or user) to clone/build/run a third-party binary from GitHub and to use an 'install-mcp' action that 'auto-registers' with Claude Desktop. Those actions may modify local agent/client configuration. The SKILL.md does not instruct reading unrelated system files, but the opaque 'install-mcp' and MCP auto-registration imply potential modification of user agent configuration outside the skill's stated extraction-only scope.
⚠ 安装机制
This is an instruction-only skill with no formal install spec recorded by the registry, yet SKILL.md and README instruct cloning arbitrary GitHub repos and building a binary locally (go build). That effectively downloads and executes code from external sources. The README and SKILL.md reference different GitHub repo owners (sirToby99 vs Nefas11) — a repository inconsistency that is a red flag and increases risk because there's no single verified release URL or signed binary.
✓ 凭证需求
The skill does not request environment variables, credentials, or config paths in the registry metadata. The SKILL.md likewise does not ask for secrets or unrelated credentials. Lack of requested secrets is proportionate to the described functionality.
ℹ 持久化与权限
The skill is not marked always:true and does not request elevated platform privileges in the registry. However, the 'install-mcp' command and claims about auto-registering with Claude Desktop suggest the binary (if run) could modify local agent/client configuration to integrate itself persistently. This behavior is not described in detail in the SKILL.md and should be examined before running.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/12
- Initial release of swipenode skill: high-speed web extraction CLI for AI agents. - Extracts structured JSON from Next.js, Nuxt.js, Gatsby, Remix—no headless browsers required. - Bypasses Cloudflare via TLS spoofing; dramatically reduces token usage compared to raw HTML. - Provides batch extraction, local agent server (MCP), and integration examples. - Clearly documents capabilities, use cases, and known limitations.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install swipenode-2
镜像加速npx clawhub@latest install swipenode-2 --registry https://cn.clawhub-mirror.com
技能文档
Lightning-fast, zero-render web extraction CLI built for AI agents. Extracts structured data (Next.js/Nuxt.js) without headless browsers.
Repo: https://github.com/sirToby99/swipenode
Binary
~/.openclaw/workspace/skills/swipenode/swipenode
Built from source (Go 1.24), single static binary, no runtime dependencies.
Commands
Extract (single URL)
~/.openclaw/workspace/skills/swipenode/swipenode extract --url
Extract + 过滤 带有 jq
~/.openclaw/workspace/skills/swipenode/swipenode extract --url https://shop.example.com | jq '.props.pageProps.product'
Batch (multiple URLs concurrently)
~/.openclaw/workspace/skills/swipenode/swipenode batch --urls "https://a.com,https://b.com"
MCP Server (对于 Claude Desktop / local agents)
~/.openclaw/workspace/skills/swipenode/swipenode mcp
Install 作为 MCP 在...中 Claude Desktop
~/.openclaw/workspace/skills/swipenode/swipenode install-mcp
什么 extracts
| Framework | Data source |
|---|---|
| Next.js | __NEXT_DATA__ JSON blob |
| Nuxt.js | window.__NUXT__ |
| Gatsby | window.___gatsby |
| Remix | window.__remixContext |
| JSON-LD |
|