Social Media Content Scraper Pro
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could pay for and rely on exported content that is fabricated or only demo data rather than scraped social media posts.
The code states the article-list parsing is simulated and must be replaced with real scraping logic, contradicting the user-facing claim that this is a working bulk social-media scraper.
"""模拟解析公众号文章，实际使用时需要配合微信客户端或API""" ... "# 这里是模拟数据，实际部署时需要替换为真实的抓取逻辑"
Do not install or pay for this skill unless the publisher removes the payment gate for the demo, clearly labels it as simulated, or provides audited working scraping code that matches the advertised platforms.
A user may be asked to pay an amount that does not match the advertised price, or may not understand what action triggers payment.
The billing code uses amounts 8 and 0, while the skill description advertises $0.005 USDT per scrape task or $4.99 lifetime access, making the actual payment behavior unclear and inconsistent.
json={"user_id": user_id, "amount": 8,} ... json={"user_id": user_id, "skill_id": SKILL_ID, "amount": 0,}Require the publisher to align the code and listing price, show the exact charge before each paid action, and document refund and lifetime-access behavior.
The skill can use an embedded billing credential to call the payment service, and users cannot tell what authority or account scope that credential has.
A production-looking SkillPay API key is hardcoded into the shipped code, while the registry declares no credentials or environment variables.
SKILLPAY_API_KEY = 'sk_d11f...'
HEADERS = {"X-API-Key": SKILLPAY_API_KEY, "Content-Type": "application/json"}Move payment credentials to a platform-managed or environment-scoped secret, disclose the payment integration in metadata, and document exactly what billing operations are permitted.
Opening a status, article, export, or other non-exempt route may trigger external billing behavior before the user has clearly approved a specific task charge.
The app attempts a billing check/charge before most routes, instead of tying payment to an explicit user-confirmed scrape action with a clearly displayed amount.
@app.before_request
def check_payment():
if not TEST_MODE and request.endpoint not in ['index', 'pay', 'static'] and not session.get('payment_verified'):
...
charge_result = charge_user(user_id)Gate billing behind an explicit confirmation step for each paid scrape, display the exact amount, and avoid automatic billing calls from generic request middleware.
Installation behavior and dependency provenance are unclear, even though this is not by itself evidence of malicious execution.
The artifact includes runnable Flask app code, but the registry provides no install specification or dependency declaration for that app.
No install spec — this is an instruction-only skill. ... Code file presence: scripts/app.py
Require a clear install spec, dependency list, and provenance information before treating the Flask app as installable.
Scraped content and task history may remain on disk after use and could be reused or exposed locally.
The app stores task history, article URLs, and article content in a local SQLite database and writes exports under the skill directory.
app.config['DATABASE'] = os.path.join(SKILL_ROOT, 'data', 'wechat.db') ... CREATE TABLE IF NOT EXISTS articles ... content TEXT, url TEXT UNIQUE
Use only if you are comfortable with local retention, and ask the publisher for clear cleanup, retention, and export-location controls.