Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Blog Writer
v1.0.0为张向阳(Astral Wave)的个人博客 astralwaveorg 生成高质量技术博客文章。当用户说"写博客xxx"、"帮我写一篇xxx"、"引用消息写成博客"、"总结今天聊天",或者 cron 触发每日聊天总结时,使用此技能。文章风格必须模拟作者本人:用工程师第一人称视角,诚实直接,有踩坑说踩坑,读起来像...
⭐ 0· 41·0 current·0 all-time
byAstralWave@astralwaveorg
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
技能名/描述与其实际行为基本一致:生成文章、写入本地 posts 目录并做本地 git commit 很符合“博客写作”用途。但脚本中硬编码的 POSTS_DIR (/Users/nora/workspace/astralwaveorg/source/_posts) 假定特定用户环境且未声明为配置项,这对大多数安装环境不成比例且容易出错。
Instruction Scope
Mode B 要求读取 sessions_history(用户当天所有会话),并把消息 JSON 传给 scripts/extract_topics.py 以提取话题——这会把私有聊天内容用于生成公开或半公开的博客,存在隐私/数据泄露风险。另有实现不一致:extract_topics.py 的 main() 仅打印占位 JSON 并提示“需要 agent 将 sessions_history 结果通过 stdin 传入”,并没有在 main 中实际解析 stdin 并输出话题,这与 SKILL.md 声称的流程(exec 脚本并解析 stdout 得到 2-3 个话题)不一致。SKILL.md 还提到用 Telegram 发送通知,但没有声明或要求 Telegram 凭据,依赖环境中额外工具/凭据,范围不明。
Install Mechanism
这是 instruction-only(无安装步骤、无下载),且包含的 Python 脚本都在清单中;没有外部 URL、包管理器或二进制下载。就安装风险而言比较低。
Credentials
技能不声明任何环境变量或凭据, 但实际运行需要文件系统写权限(写入 POSTS_DIR)、git 仓库访问以及访问 sessions_history(agent 会话历史)。写入硬编码到特定用户目录的要求不合理且未被声明。Telegram 通知暗示需要外部凭据但未列出,这可能导致 agents 使用全局或其他技能的凭据以完成通知,或导致失败/意外暴露。总体上,数据访问(聊天记录)与写入位置权限没有得到适当声明。
Persistence & Privilege
技能不会设置 always:true,且不包含 install steps 修改其他技能或系统设置。它会创建文件并在本地执行 git add/commit(但不 push),对本地仓库有持久写入;这是博客技能能合理要求的权限,但写入路径被硬编码且没有用户确认步骤会增加风险。
What to consider before installing
Key things to consider before installing or enabling:
- Privacy: Mode B reads sessions_history (all sessions of the day). If enabled, private chat content could be incorporated into drafted posts. Only enable if you explicitly want agent conversations summarized as blog drafts and you trust the agent environment.
- Hardcoded path: scripts/new_post.py writes to /Users/nora/workspace/astralwaveorg/source/_posts. That path is specific to a user and likely incorrect for your environment — change POSTS_DIR to your repo path or make it configurable before use.
- Implementation mismatch: scripts/extract_topics.py does not actually parse stdin in its main() — it prints a placeholder JSON. The SKILL.md claims the agent will exec this script and parse topics from stdout; right now that flow is broken or incomplete. Fix or validate the script logic.
- Notifications: SKILL.md says to send Telegram notifications but no token/config is declared. Determine which tool will send Telegram messages and where its credentials come from; prefer explicit config variables rather than implicit global tokens.
- File review & git behavior: The skill auto-creates files and runs git add + commit (no push). Review created files before deploying/pushing. Ensure the agent runs with a least-privilege account and that commits are created under an expected identity.
- Test in a safe environment: Run the scripts locally in a test repo first to confirm behavior (especially extract_topics.py and new_post.py), and verify the sessions_history→extract pipeline behaves as you expect.
If you want, I can: (1) point out exact lines to change to make POSTS_DIR configurable, (2) produce a corrected extract_topics.main() that actually reads stdin and outputs topics, or (3) draft a minimal wrapper that prompts for confirmation before writing/committing.Like a lobster shell, security has layers — review code before you run it.
blogvk97ekkach1762mbc9k4ewmj4dh83ww56hexovk97ekkach1762mbc9k4ewmj4dh83ww56latestvk97ekkach1762mbc9k4ewmj4dh83ww56writingvk97ekkach1762mbc9k4ewmj4dh83ww56
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
