Hellobike
v0.1.0Summarizes public service details, announcements, and city-specific info from Hellobike's official pages without accessing user accounts or orders.
⭐ 0· 114·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the SKILL.md: it only claims to scrape and summarize public service and announcement pages. There are no unrelated environment variables, binaries, or install steps requested.
Instruction Scope
SKILL.md limits activity to publicly accessible pages, extraction of obvious fields (titles, times, prices), and explicitly forbids account/order operations. It asks to wait for dynamic loading and to respect rate limits — an implementation detail but not scope creep. It does not request access to local files, secrets, or other system state.
Install Mechanism
There is no install spec and no code files (instruction-only), so nothing will be written to disk by the skill itself. This is the lowest-risk pattern for install behavior.
Credentials
The skill requires no environment variables, credentials, or config paths. The declared needs are minimal and proportionate to web-scraping public pages.
Persistence & Privilege
always is false and the skill does not request persistent or elevated agent-wide privileges. It does not instruct modifying other skills or global agent settings.
Assessment
This skill appears coherent and minimal: it only summarizes public Hellobike pages and asks for no credentials. Things to consider before installing: (1) the skill is instruction-only and the agent runtime will perform the web fetching — ensure the agent's fetcher won't attach cookies, stored credentials, or other site-specific auth by mistake; (2) dynamic pages imply a headless browser or JS-capable fetcher may be used — verify your environment's browser binaries and network policies are acceptable; (3) respect site terms and rate limits to avoid being blocked; and (4) the skill's source is unknown, so if you require stronger assurance, run it in a restricted/testing agent first and monitor network requests and data output.Like a lobster shell, security has layers — review code before you run it.
latestvk979vmjwxx5vbee5frywfk4q9d833m8c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.