Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
微信公众号文章抓取（Alex版）
v1.0.0微信公众号文章抓取工具。当用户发送 mp.weixin.qq.com 链接时自动触发，将文章内容提取为 Markdown/文本，无需 API 密钥。
⭐ 0· 162·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the instructions: the skill fetches mp.weixin.qq.com articles and returns Markdown/text via an HTTP GET to a public extractor service. No unrelated env vars or binaries are requested.
Instruction Scope
Runtime instructions explicitly send the article URL to https://down.mptext.top/api/public/v1/download?url=...&format=... — this forwards user-supplied URLs (and the extractor returns article content) to a third party. The SKILL.md does not limit or warn about privacy/consent, nor does it offer a local scraping fallback. Directing user content to an external host outside the source site is a notable data‑leakage/privacy concern.
Install Mechanism
Instruction-only skill with no install spec and no code files. Nothing is written to disk or downloaded by the skill itself, which minimizes install-time risk.
Credentials
The skill requests no credentials or config paths. However, despite no env vars being requested, it still exfiltrates data at runtime via network calls to a third party — this is a behavioral (not credential) risk.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request elevated persistence or modify other skills. Autonomous invocation is allowed by platform default but not newly privileged here.
What to consider before installing
This skill will send any mp.weixin.qq.com link a user provides to the public service down.mptext.top to produce Markdown/text. Before installing, consider: (1) Do you trust down.mptext.top to receive and keep those URLs and the scraped content? The site could log or republish content, including copyrighted or private material. (2) If you need stronger privacy or auditability, prefer a local scraper or a trusted/official API. (3) If you proceed, test with non-sensitive links first and confirm the extractor's behavior and retention/privacy policy. If the maintainer or domain reputation is unknown, treat this as a privacy risk and avoid using for confidential content. Additional information that would lower risk: documentation or reputation for down.mptext.top (official project, source code, clear privacy policy), or a version of the skill that performs scraping locally instead of forwarding content to a third party.Like a lobster shell, security has layers — review code before you run it.
latestvk97f036pme9paq00kxzsybyymx84heqf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.