by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to implement automated, browser-driven submission to many directories which matches its description, but there are some red flags you should consider before running it:
- Transport security: check_directory.py disables SSL verification (ssl=False). Remove or change this before running to avoid MITM risk.
- Packaging inconsistencies: a submit_to_directory.py file is just a '404' placeholder and the README references a --target option the main script doesn't accept. Expect to e...详细分析 ▾
ℹ 用途与能力
Name/description align with the included scripts: Playwright-based form-filling and aiohttp checks for directories. The provided directories list and automation code match the claimed purpose. Minor mismatches: there is a scripts/submit_to_directory.py file that contains only '404: Not Found' (unused) and targets/README.md suggests a --target CLI option that the main script does not implement. These inconsistencies suggest sloppy packaging but not necessarily malicious intent.
⚠ 指令范围
SKILL.md instructs installing Playwright and running the provided scripts which is consistent. However, check_directory.py explicitly disables SSL verification (aiohttp request with ssl=False), which is unnecessary for simple directory detection and weakens transport security (allows MITM). The automation will programmatically fill and submit forms across many sites — this is coherent with the stated purpose but also enables mass unsolicited submissions / spam and may violate target sites' terms of service or trigger captchas/rate limits. The skill does not handle captchas, credentialed sites, or legal/terms checks, and it offers no safeguards beyond a small delay.
ℹ 安装机制
There is no registry install spec (instruction-only skill), and SKILL.md instructs the user to pip install playwright and run its installation step. That's expected for a Playwright-based tool. Nothing in the registry installs arbitrary third-party binaries, but following the SKILL.md will download Chromium via Playwright's installer — normal but networked.
✓ 凭证需求
The skill requests no environment variables or credentials and does not access system config paths. That is proportionate to its purpose. It still asks the user to supply site data (name, email, URL) at run time; no hidden credential requests were found.
✓ 持久化与权限
always is false and the skill does not request persistent privileges or modify other skills or system-wide settings. It writes local JSON result files only. Autonomous invocation is allowed by default but not combined with other privileged requests.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/13
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install seo-backlink-submitter
镜像加速npx clawhub@latest install seo-backlink-submitter --registry https://cn.longxiaskill.com镜像同步中