Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

douyin-spark

v1.0.0

自动识别抖音带火花联系人,批量发送自定义消息续火花,支持列表管理和重燃火花进度追踪。

0· 192·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (auto-identify spark contacts and send messages) matches the provided JS and SKILL.md instructions. The included script parses a local contacts file and prints/outputs the browser actions to perform; SKILL.md instructs the agent to navigate, snapshot, click, type and send messages in Douyin — all coherent with the declared purpose.
Instruction Scope
Instructions are focused on interacting with Douyin via the OpenClaw browser tool and reference a local contacts file (~/.openclaw/.../douyin-spark-contacts.md). That file will be read by the script to determine recipients. This is expected for the feature, but it means the skill will access your local workspace file and control a logged-in Douyin session if executed.
Install Mechanism
No install spec — instruction-only with an optional Node.js helper script. No downloads from external URLs or package installs are performed by the skill itself.
Credentials
The skill requests no environment variables or external credentials. It reads HOME/USERPROFILE to locate the contacts file (standard and proportional). It relies on the user having a logged-in Douyin web session and the OpenClaw browser tool available — these are reasonable for its function.
Persistence & Privilege
always is false and the skill does not request elevated system-wide privileges or modify other skills. It only uses files inside the user's OpenClaw workspace and does not claim or require persistent/system-level access.
Assessment
This skill appears to do what it says: it uses the OpenClaw browser tool to send messages to contacts listed in a local file so that Douyin 'spark' icons stay lit. Before installing or using it: (1) inspect and sanitize memory/douyin-spark-contacts.md — only include contacts you want automated messages sent to; (2) be aware the agent/browser will act with your logged-in Douyin account — excessive or repetitive automated messages can trigger rate limits or account sanctions, so avoid high-frequency or spammy content; (3) there are no external network endpoints in the package, but review the script if you plan to run npm link or execute it locally; (4) consider whether you want the AI to invoke this autonomously in conversations — disable autonomous invocation in your agent if you prefer manual control; (5) if you plan to publish or use this commercially, check Douyin terms of service. Overall the skill is internally consistent, but use caution for privacy and platform-policy reasons.
douyin-spark.js:69
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cy9p9ee2pbb0dvv37zw37x18337za
192downloads
0stars
1versions
Updated 3h ago
v1.0.0
MIT-0

抖音自动续火花技能

自动为抖音私信联系人续火花,保持火花标识不灭。

功能

  • 自动识别有火花图标的联系人(名字旁边带数字的)
  • 批量发送续火花消息
  • 支持自定义消息内容
  • 记录火花联系人列表
  • 自动追踪重燃中火花的进度

使用方法

在 OpenClaw 对话中使用(推荐)

直接告诉 AI 助手:

帮我续火花
给火花联系人发消息
续火花,说:你好呀
查看火花联系人列表
把 XXX 加到火花联系人

AI 助手执行流程

当用户说"续火花"时,AI 助手应:

  1. 打开抖音聊天页面

    browser action=navigate url=https://www.douyin.com/chat?isPopup=1
    
  2. 获取联系人列表快照(使用 refs="role")

    browser action=snapshot refs=role
    
  3. 逐个点击联系人并发送消息

    • 点击联系人(通过 ref 定位)
    • 在输入框(ref=e713)输入消息
    • 按 Enter 发送
  4. 发送默认消息我是 ai 续火花助手,我来续火花了

  5. 报告发送结果,包括每个联系人的火花天数和状态

查看联系人列表

node ~/.openclaw/workspace/skills/douyin-spark/douyin-spark.js --list

配置文件

联系人列表保存在:~/.openclaw/workspace/memory/douyin-spark-contacts.md

火花规则

  • 灰色火花:超过 24 小时不聊天变灰,发消息可重新点亮
  • 彩色火花:连续聊天保持
  • 重燃中:火花已灭,需连续聊 3 天恢复(显示 X/3 进度)

注意事项

  • 每天至少发一次消息保持火花
  • 避免发送相同内容(可能被限流)
  • 群聊也可以有火花
  • 发送消息后等待 1-2 秒再发下一个,避免限流

浏览器操作要点

  • 使用 refs="role" 获取稳定的元素引用
  • 输入框通常是 ref=e713(发送消息输入框)
  • 联系人列表项包含用户名和火花天数
  • 重燃中的火花显示为"重燃中 X/3"

依赖

  • OpenClaw 浏览器工具
  • 抖音网页版已登录

Comments

Loading comments...