by 安全扫描
OpenClaw
可疑
medium confidence该技能基本符合其所述用途（抓取论坛），但会请求并操作本地论坛 cookie 文件，并在 Node VM 中执行不受信任的 JavaScript——对抓取而言合理，但涉及隐私与执行沙箱问题，安装前请审慎评估。
评估建议
This skill is a coherent forum scraper, but it needs a local cookie file (cookie.txt) containing your forum session cookies — treat that like a password. Before installing: (1) verify you trust the skill source and the forum; (2) consider creating a throwaway forum account or limited-session cookie instead of using your main account; (3) run the skill in an isolated environment/container; (4) inspect cookie.txt contents and file permissions (avoid storing other credentials); (5) be aware the cod...详细分析 ▾
✓ 用途与能力
Name, description, SKILL.md, package.json, and code files all consistently implement a forum scraper for https://www.wnflb2023.com. Dependencies (cheerio, undici) and the npm install instruction are appropriate for HTML fetching/parsing.
ℹ 指令范围
SKILL.md explicitly requires reading a local cookie.txt and running node main.js to scrape and check-in. That is within scope for a logged-in forum scraper, but the skill instructs the agent to read/write a cookie file in the skill directory (session tokens) and to extract potentially sensitive content (links/passwords). The README's demand that cookie.txt be "only readable by this skill" is odd and not enforceable by the skill itself.
ℹ 安装机制
There is no formal install spec; SKILL.md requires running 'npm install' which will fetch packages from the npm registry (cheerio, undici). This is a normal, moderate-risk action — no third-party download URLs or extract steps are present.
⚠ 凭证需求
The skill does not request environment variables but requires a local cookie file containing forum session cookies. Cookies are effectively credentials and will be read and updated by the skill (readCookie/writeCookie). This is proportionate for a logged-in scraper, but users should be aware that these cookies may grant access to their forum account and should not contain other site/session tokens.
✓ 持久化与权限
The skill does not request 'always: true' or any elevated platform privileges. It reads/writes its own cookie file in its directory and does not modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/4/20
福利吧（wnflb）Skill首次发布，支持抓取与总结论坛帖子内容。 - 支持从福利吧指定板块（发现之门、综合讨论、购物网赚等）抓取帖子标题、正文与链接并归纳总结。 - 默认抓取“发现之门”板块的10条最新帖子，支持用户自定义板块与数量。 - 显示AI生成的内容摘要，自动提取网盘链接与密码，表格格式美观输出。 - 提供论坛签到功能，返回签到状态及相关链接。 - 需配置cookie.txt文件且依赖Node.js 22+环境。
● Pending
安装命令
点击复制官方npx clawhub@latest install wnflb
镜像加速npx clawhub@latest install wnflb --registry https://cn.longxiaskill.com镜像同步中
技能文档
---|------|----------| | 1 | xxxxxxx | xxxxxx |
论坛签到
- 独立功能，需先完成 cookie 准备（见步骤 1）
- 执行：
- 返回示例：