by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's purpose (crawl Aliyun Model Studio and regenerate derived skills) matches the included scripts, but there are inconsistent runtime assumptions (npx usage not declared, path mismatches) and it instructs executing an npm package via npx which carries moderate risk.
评估建议
This skill appears to do what it says (crawl the Aliyun Model Studio page and generate summaries and suggested skills), but review a few things before running it:
- Path mismatch: SKILL.md runs scripts at skills/ai/misc/.../scripts/*.py but the repository has scripts/refresh_*.py at top-level scripts/. Confirm the expected location or adjust commands to point to the included files; otherwise the workflow may fail or the scripts may compute wrong ROOT paths.
- npx risk: The workflow uses `npx -y...详细分析 ▾
ℹ 用途与能力
The name/description match the included Python scripts which parse a crawl and produce summaries and skill suggestions. However, SKILL.md lists Node.js/npx as a prerequisite while the skill metadata declares no required binaries; the SKILL.md command paths reference scripts under skills/ai/misc/... but the shipped files live at scripts/*.py. These mismatches mean the runtime layout the instructions expect may not match how the skill is installed or executed.
⚠ 指令范围
Instructions tell the agent to run an npx command that downloads and executes @just-every/crawl against https://help.aliyun.com and then run bundled Python scripts that read/write files. The crawling step contacts an external site (expected) but uses npx which will fetch and execute code from npm (arbitrary code execution). The SKILL.md also asks to save evidence including 'region/resource id/time range' which could encourage including environment-specific identifiers in outputs; while not secrets by name, this increases what gets written to disk and possibly shared.
ℹ 安装机制
There is no install spec (instruction-only), which reduces installer risk. However, the workflow relies on npx -y @just-every/crawl (transiently pulling an npm package and executing it). Relying on npx to run a remote package is a moderate install/execution risk unless the package and version are audited or pinned. The Python scripts are local and simple text processing (no external downloads).
✓ 凭证需求
The skill declares no required environment variables or credentials, and the Python scripts do not read secrets or env vars. The only external access is network to the public help.aliyun.com site. Asking to record 'region/resource id/time range' in evidence is informational and not a request for secrets.
✓ 持久化与权限
always is false and the skill does not request persistent or system-wide privileges. It writes outputs into an output/ subdirectory and generated skills under skills/ai/** per instructions — this is expected for a content-generation workflow and not an escalation of privilege.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/1
- Initial release of aliyun-modelstudio-crawl-and-skill. - Automates crawling of Alibaba Cloud Model Studio models and regeneration of skills in `skills/ai/**`. - Outputs structured model lists, cleaned summaries, skill coverage reports, and generated skills. - Includes validation scripts and reproducibility guidelines. - Supports updating documentation files if the skills list changes.
● 无害
安装命令
点击复制官方npx clawhub@latest install aliyun-modelstudio-crawl-and-skill
镜像加速npx clawhub@latest install aliyun-modelstudio-crawl-and-skill --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Aliyun Modelstudio Crawl And Skill — 技能工具 安装说明： 安装命令：npx clawhub@latest install aliyun-modelstudio-crawl-and-skill 该技能用于淘宝相关操作，可能需要相应的平台账号或API密钥
技能文档
Category: task
# Alibaba Cloud Model Studio Crawl and Skill Generation
Prerequisites
- Node.js (for
npx) - Python 3
- Network access to the models page
Workflow
1) Crawl models page (raw markdown)
npx -y @just-every/crawl \"https://help.aliyun.com/zh/model-studio/models\" > alicloud-model-studio-models.md
2) Rebuild summary (models + API/usage links)
python3 skills/ai/misc/aliyun-modelstudio-crawl-and-skill/scripts/refresh_models_summary.py
3) Regenerate skills (creates/updates skills/ai/)
python3 skills/ai/misc/aliyun-modelstudio-crawl-and-skill/scripts/refresh_alicloud_skills.py
Outputs
alicloud-model-studio-models.md: raw crawl outputoutput/alicloud-model-studio-models-summary.md: cleaned summaryoutput/alicloud-model-studio-models.json: structured model listoutput/alicloud-model-studio-skill-scan.md: skill coverage reportskills/ai/: generated skills
Notes
- Do not invent model IDs or API endpoints; only use links present on the models page.
- After regeneration, update
README.md,README.en.md, andREADME.zh-TW.mdif skills list changed.
Validation
mkdir -p output/aliyun-modelstudio-crawl-and-skill
for f in skills/ai/misc/aliyun-modelstudio-crawl-and-skill/scripts/*.py; do
python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/aliyun-modelstudio-crawl-and-skill/validate.txt
Pass criteria: command exits 0 and output/aliyun-modelstudio-crawl-and-skill/validate.txt is generated.
Output And Evidence
- Save artifacts, command outputs, and API response summaries under
output/aliyun-modelstudio-crawl-and-skill/. - Include key parameters (region/resource id/time range) in evidence files for reproducibility.
References
- Source list:
references/sources.md