by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and instructions match its stated purpose of extracting HackerNews posts, but its registry flag always: true (force-included every run) is unnecessary and increases risk; otherwise the skill is coherent and has no requested secrets.
评估建议
This skill appears to do what it says: fetch HN metadata and the linked article, clean it, and produce markdown. It requires 'uv' and will make outbound HTTP requests to hn.algolia.com and whatever article URLs are linked (expected behavior). The main concern is the registry flag always: true — that makes the skill available in every agent run and increases exposure without an obvious reason. Before installing, consider: 1) Do you want this skill force-enabled for all agents? If not, ask the pub...详细分析 ▾
✓ 用途与能力
Name/description align with the code and instructions: the script fetches HN metadata from hn.algolia.com, downloads the linked article HTML, cleans it, and writes combined Markdown. The only required binary is 'uv', which the SKILL.md and shebang explain is used to run the script and manage Python deps.
ℹ 指令范围
SKILL.md gives explicit runtime steps: run the Python script via 'uv', then upload the generated file in a single message tool call and optionally ask whether to summarize. These instructions are scoped to delivering the extracted file to the user/agent. Note: the script fetches arbitrary article URLs (expected for this tool) and can read an input .json file if provided — both are consistent with the stated purpose but mean the skill performs outbound network requests and can read local JSON files passed as inputs.
✓ 安装机制
No install spec is provided beyond requiring 'uv' on PATH. The script declares its Python dependencies in header comments (uv will install them into a venv at run time). This is low-risk compared to arbitrary remote installers or embedded binary downloads.
✓ 凭证需求
The skill requests no environment variables, no credentials, and no config paths. That is appropriate for an extractor that operates with public HN APIs and by fetching public article URLs.
⚠ 持久化与权限
The registry flag always: true forces the skill to be included in every agent run. There is no justification in the SKILL.md for it to be always active — an extraction tool does not normally require permanent inclusion. always:true increases the attack surface and should be questioned or removed unless a clear reason is provided.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSmacOS · Linux · Windows
版本
latestv0.1.52026/2/3
hn-extract 0.1.5 - Updated documentation to clarify accepted inputs: now specifies support for only HackerNews ID or URL, removing reference to saved Algolia JSON files. - Examples and usage instructions streamlined to match supported input types. - Notes section updated to remove mention of article retrieval using trafilatura and Algolia specifics.
● 无害
安装命令 点击复制
官方npx clawhub@latest install hn-extract
镜像加速npx clawhub@latest install hn-extract --registry https://cn.clawhub-mirror.com
技能文档
Extract a HackerNews post (article + comments) into single clean Markdown for quick reading or LLM input.
see Examples
What it does
- Accepts an HackerNews id or url
- Download the linked article HTML, cleans and formats it.
- Fetches the Hacknews post metadata and comments.
- Outputs a readable combined markdown file with original article, threaded comments, and key metadata.
Requirements
uvinstalled and in PATH.
Install
No install beyond having uv.
Dependencies will be installed automatically by uv into to a dedicated venv when run this script.
Usage Workflow (Mandatory for Agents)
When an agent is asked to extract a HackerNews post:
- Run the script with an output path:
uv run --script ${baseDir}/hn-extract.py -o /tmp/hn-..md - Send ONE combined message: Upload the file and ask the question in the same tool call. Use the
messagetool (action=send,filePath="/tmp/hn-,.md" message="Extraction complete. Do you want me to summarize it?"). - Do not output the full text or a summary directly in the chat unless specifically requested.
Usage
# run as uv script
uv run --script ${baseDir}/hn-extract.py [-o path/to/output.md]# Examples
uv run --script ${baseDir}/hn-extract.py 46861313 -o /tmp/output.md
uv run --script ${baseDir}/hn-extract.py "https://news.ycombinator.com/item?id=46861313"
- Omit
-oto print to stdout. - Directories for
-oare created automatically.
Notes
- Retries are enabled for HTTP fetches.
- Comments are indented by thread depth.
- Sites requires authentication or blocks scraping may still fail.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制