by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do exactly what it says: it controls a local browser via the debugging (CDP) interface to open Didi pages, call in-page functions or click buttons, and capture API responses to list/claim coupons. Things to consider before installing:
- The script operates on the browser session you run it against: you must log into Didi in that browser and the script will use those cookies to act as your account. Only run it if you trust the code and the environment.
- It connects to local...详细分析 ▾
✓ 用途与能力
Name/description claim to open Didi coupon page and click/trigger MPX methods; the skill requires Node and a browser CDP connection and uses those to navigate, call in-page methods, and parse API responses — this is proportional to the purpose.
ℹ 指令范围
Instructions explicitly require starting the OpenClaw browser (CDP port 18800), logging into the user's Didi account in that browser, running the Node script, and optionally installing a cron job. The script evaluates code inside the page and intercepts network responses to read coupon data — this is necessary for the task but does require access to the user's browser session/cookies (sensitive).
✓ 安装机制
No install spec; the skill is instruction + one script. It imports the 'ws' module either from workspace node_modules (../../../node_modules/ws/wrapper.mjs) or falls back to the globally installed 'ws' — this is brittle but expected for the declared runtime; no remote downloads or archives are used.
ℹ 凭证需求
The skill doesn't request environment variables or credentials. However, it depends on the user's logged-in browser cookies and CDP access on localhost:18800 to act as the user's Didi session, which is necessary but privacy-sensitive (it has same privileges as the browser session it connects to).
✓ 持久化与权限
The skill is not always:true and does not request elevated platform privileges. SKILL.md suggests creating a scheduled job (cron) for daily runs; scheduling is user-facing guidance and not enforced by the skill manifest. Autonomous invocation remains possible (platform default).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.1.12026/3/13
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install didi-coupon-auto
镜像加速npx clawhub@latest install didi-coupon-auto --registry https://cn.longxiaskill.com