Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Fetch Archive to Lexiang

v0.1.2

通用文章抓取与归档工具。抓取任意 URL(免费/付费/登录墙)的文章全文,转换为结构化 Markdown,并可选转存到乐享知识库。支持 Substack、Medium、知识星球等付费平台的登录态管理。支持 YouTube 视频下载(yt-dlp)、播客音频下载(小宇宙FM等)、音频转录(Whisper)、翻译(中...

0· 132·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's need to read browser cookies, reuse Chrome CDP, and optionally restart Chrome is coherent with its stated purpose of fetching paywalled/login-protected articles. Using Playwright + cookie injection or connecting over CDP to a real Chrome instance is an expected (if intrusive) technique for that goal. However, the README/SKILL.md promise of automatic upload to the Lexiang knowledgebase implies the skill will need an access token or MCP config, but the registry metadata lists no required credentials — a documentation/metadata mismatch.
!
Instruction Scope
SKILL.md and scripts explicitly instruct the agent to read the local Chrome Cookies DB, extract or decrypt cookies, inject cookies into Playwright contexts, detect Cloudflare challenges, and optionally connect to/restart the user's real Chrome via CDP (port 9222). The scripts also write persistent files (~/.substack/storage_state.json, ~/.fetch_article/*) and may attempt to gracefully close and relaunch Chrome. These operations access and persist sensitive authentication state and manipulate a running browser process — they go beyond simple HTTP fetching and are high-impact actions for an installed skill.
Install Mechanism
No formal install spec is declared (instruction-only install), but the bundle contains runnable Python scripts. The README instructs the agent to clone a GitHub repo and auto-install dependencies; the skill may therefore cause the agent to install Playwright, yt-dlp, Whisper, ffmpeg, and Python packages at runtime. There is no external arbitrary-download URL in the skill bundle itself, which reduces one class of risk, but automatic dependency installation increases runtime privilege and side-effect surface.
!
Credentials
Registry metadata lists no required environment variables, yet the scripts expect and optionally use secrets/credentials: yt_download_transcribe.py checks OPENAI_API_KEY for translation, README refers to 'lexiang MCP' token for uploading to the Lexiang server, and scripts persist session state under the user's home directory. The skill also accesses Chrome cookie DB and (on macOS) may use Keychain-related methods. The absence of declared env requirements (OPENAI_API_KEY, lexiang token) is an inconsistency that hides important secret usage.
!
Persistence & Privilege
The skill writes persistent files into the user's home (~/.substack/storage_state.json, ~/.fetch_article/chrome_cdp_profile, config.json), caches login state for subsequent reuse, and can start/stop the user's Chrome process with specific flags to enable CDP. While storing its own state is expected, restarting the user's real browser and writing persistent session artifacts increases the privilege and persistence footprint and should be considered intrusive.
What to consider before installing
This skill will attempt to read and reuse your browser login state (Chrome cookie DB and/or connect to your real Chrome via CDP), may try to close and relaunch Chrome with debugging flags, and will persist session artifacts in your home directory (e.g. ~/.substack/storage_state.json and ~/.fetch_article/*). It also can call the OpenAI API for translations (OPENAI_API_KEY) and upload content to the Lexiang knowledgebase (requires a Lexiang/MCP token) even though those env vars/tokens are not declared in the registry metadata. Before installing: - Understand the risk: granting this skill access to your browser cookies or allowing it to start Chrome CDP effectively gives it the ability to fetch any content your browser can access (including paywalled content) and reuse your logins. - If you only want to fetch public pages, prefer running fetches in a disposable browser profile or run the scripts locally yourself rather than allowing autonomous agent actions. - Do NOT point the skill at your primary browser profile unless you trust the code and repository owner; instead create and use a dedicated Chrome profile or a separate VM/container. - Inspect the scripts yourself (they are included) and search for any hardcoded upload endpoints or unexpected network calls. Confirm where uploads go and how the Lexiang token is provided. - Provide OPENAI_API_KEY or Lexiang tokens only if you understand and accept how they will be used; expect these to be required for translation/upload features. - If you do install, consider disabling autonomous invocation (set disable-model-invocation = true in agent config) or run the skill with manual approval for each action. Given the sensitive local access and the metadata mismatches, proceed only if you are comfortable with these behaviors or can run the tool in an isolated/test environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk976y4n4z0sxw1qh8kk6e61znx83wck6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments