by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: download books, extract text, and track reading progress in ~/.openclaw/workspace. Before installing or running: 1) Ensure you have the runtime tools the script actually needs — SKILL.md omits jq (the script uses jq for JSON parsing), and the Python EPUB path requires ebooklib and bs4/lxml if pandoc is not present. 2) Be mindful of legality and ethics: the script can download from arbitrary URLs and references Anna's Archive (a shadow library); avoid downlo...详细分析 ▾
✓ 用途与能力
The script and SKILL.md align with the stated purpose: searching Gutenberg, downloading EPUB/PDF/TXT, extracting text, and storing reading progress. Declared dependencies (pandoc, pdftotext, Python ebook libs) map to the code's EPUB/PDF handling. One small mismatch: the script uses jq for JSON processing but jq is not mentioned in SKILL.md or the registry metadata.
✓ 指令范围
Runtime instructions and the script stay within the declared scope: downloading books (from user-supplied URLs or Gutendex), extracting text, and saving progress to a local workspace (~/.openclaw/workspace). The skill does not instruct reading unrelated system files or exfiltrating data to third-party endpoints beyond fetching book sources and calling the Gutendex API. It mentions Anna's Archive as a source but does not automate access to it (the script points users to the site manually).
✓ 安装机制
There is no install spec (instruction-only), so nothing arbitrary is downloaded or executed during installation. Dependencies are installed by the user via OS package manager or pip per SKILL.md. This is the lower-risk pattern.
✓ 凭证需求
The skill requests no secrets or privileged environment variables. It optionally respects OPENCLAW_WORKSPACE to change its storage location; otherwise it writes state under ~/.openclaw/workspace, which is proportional to its functionality.
✓ 持久化与权限
always is false and the skill does not request persistent platform-wide privileges. It stores only its own reading-state file under its workspace and does not modify other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/14
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install book-reader
镜像加速npx clawhub@latest install book-reader --registry https://cn.longxiaskill.com