📦 Auto Building — 自动生成系统
v1.0.0基于 AUTO-BUILDING 源码，一键生成信息采集管理系统；用户设定栏目、分类与数据源后，系统自动完成采集、审核与发布，快速搭建专属内容平台。
0· 438·1 当前·1 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
安全
medium confidenceThe skill's stated purpose (building a content-aggregation system) aligns with its requirements and instructions, but it instructs you to clone and run an external GitHub repo — review that remote code and dependencies before executing.
评估建议
This skill description and instructions are coherent for building a scraping/aggregation site, but the package itself is instruction-only and points you to clone and run a GitHub repository. Before installing or running it: 1) Inspect the repository (https://github.com/hasd52636-a11y/Auto_Building_new) — review package.json, scripts, and any server-side code for unexpected network calls, credential handling, or malware. 2) Run npm install and the app in a sandbox or isolated environment (contain...详细分析 ▾
✓ 用途与能力
Name/description (auto content-aggregation) match the declared requirements: Node/npm are required and the SKILL.md instructs cloning and running a Node app. Nothing in the skill metadata requests unrelated credentials, binaries, or config paths.
ℹ 指令范围
SKILL.md explicitly directs the agent/user to clone https://github.com/hasd52636-a11y/Auto_Building_new, run npm install, and run the app; it also instructs editing config/sources.json and running scraping tasks. These actions are consistent with the stated purpose but involve executing code fetched from a remote repository and initiating web scraping, so the remote repository's contents determine actual runtime behavior and risk.
ℹ 安装机制
There is no bundled install payload in the skill package; the instructions point to a GitHub repo (well-known host) to clone. Using GitHub is expected for this purpose, but because the skill does not include the repo code, the reviewer could not inspect the actual runtime code. The SKILL.md also contains an 'install' clone entry referencing the same GitHub repo — consistent but worth verifying.
✓ 凭证需求
No environment variables or credentials are requested by the skill package. The described functionality (scraping external sources) normally does not require platform secrets. Beware that the cloned repository could itself request or use credentials at runtime (not visible in this package).
✓ 持久化与权限
Skill is not marked always:true and uses normal, user-invocable/autonomous defaults. It does not request elevated platform persistence or modify other skills. Running the upstream app may require setting up scheduled jobs (e.g., npm run daily), but that's standard for this kind of application.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/3
Initial release: Automated content aggregation system based on AUTO-BUILDING source code
● 可疑
安装命令
点击复制官方npx clawhub@latest install auto-building
镜像加速npx clawhub@latest install auto-building --registry https://cn.longxiaskill.com