📦 Church Account — 教会账户自动化
v1.0.0自动登录 churchofjesuschrist.org 与 LCR（领袖文书资源），批量查询教区/支会名册、管理成员信息、下载报表，一键完成教会日常行政任务。
0· 555·1 当前·1 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions match its stated purpose (automating LDS/LCR logins) but omit and contradict important operational details (undeclared dependencies, missing credential declarations, and instructions that weaken browser sandboxing), so proceed with caution.
评估建议
This skill appears to be what it says (automating LDS/LCR website tasks) but it has several red flags you should consider before installing or running it:
- Missing declarations: The SKILL.md expects Python, Playwright, playwright-stealth, and a Chromium browser but the skill metadata lists no required binaries or install steps. Verify and install these dependencies from official sources yourself rather than trusting an unknown installer.
- Credentials handling: The code expects USERNAME and PA...详细分析 ▾
ℹ 用途与能力
The name/description and SKILL.md are coherent: both describe automating churchofjesuschrist.org/LCR tasks via a browser automation flow. However, the skill fails to declare the real runtime requirements (Python, Playwright, playwright-stealth, and a Chromium browser), which is an inconsistency.
⚠ 指令范围
Instructions explicitly tell the agent how to perform OAuth login, manage sessions, and persist storage_state (auth tokens) to disk. They also recommend using playwright-stealth and pass browser args including --no-sandbox and --disable-blink-features=AutomationControlled to avoid detection. Saving storage_state and cookies to /tmp and using stealth flags broaden the sensitive scope and weaken sandbox protections; the instructions give the agent discretion over sensitive items without safe-handling specifics.
ℹ 安装机制
There is no install spec (instruction-only), which minimizes installer risk, but the runtime code requires Playwright, playwright-stealth, and Chromium. Those are not declared in metadata; a user would need to install them manually. The absence of an install spec plus required binaries is an operational mismatch to be aware of.
⚠ 凭证需求
SKILL.md expects credentials (USERNAME, PASSWORD) and suggests storing them in a vault or env vars, but requires.env and primary credential are empty. Sensitive artifacts (storage_state JSON) are written to /tmp with no guidance on encryption/permissions. Requesting credential usage without declaring them is disproportionate and risky.
ℹ 持久化与权限
The skill does not request always:true nor modify other skills. It does instruct saving persistent session state and cookies to disk which is normal for session reuse but creates long-lived sensitive artifacts; treat these files as secrets and protect them appropriately.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/17
Initial release
● 可疑
安装命令
点击复制官方npx clawhub@latest install church-account
镜像加速npx clawhub@latest install church-account --registry https://cn.longxiaskill.com