网络安全情报爬虫

What to check before installing/using this skill: - Metadata mismatch: the registry entry lists no required env vars, but SKILL.md and the scripts require IMA_OPENAPI_CLIENTID and IMA_OPENAPI_APIKEY (mandatory) and MINIMAX_API_KEY (for translation). Do not rely on the registry metadata alone. - Inspect run.sh: SKILL.md and instructions reference scripts/run.sh and say it hard-codes the IMA credentials. The manifest does not include run.sh — ask the author for the file or inspect it before running. If it hardcodes credentials, remove them and use environment variables instead. - openclaw.json access: vuln_crawler.py will try to read a global openclaw.json to fetch a MiniMax key if MINIMAX_API_KEY is not set. That means the skill attempts to read agent-level configuration outside its directory. If you keep other secrets in openclaw.json, this skill could read them (the code only looks for a specific key path, but it's still reading the file). Consider setting MINIMAX_API_KEY explicitly in the environment and/or ensure openclaw.json does not contain other sensitive secrets. - Credential scope: only provide the IMA note credentials to this skill (and the MINIMAX API key only if you need automatic translation). Avoid giving the skill broader credentials (e.g., AWS keys) — they are unnecessary for its stated purpose. - Cron/privilege changes: the SKILL.md suggests adding hourly cron jobs and uses system-level commands in examples. The included scripts do not automatically install cron entries, but if you or a provided run.sh install cron entries, verify it does not modify unrelated system configuration or include hardcoded secrets. - Audit network endpoints: the scripts contact the IMA API (https://ima.qq.com) and MiniMax (https://api.minimaxi.com) and fetch many external RSS URLs. If you have network egress policies, allow only the expected endpoints. - Missing files / truncated code: the provided vuln_crawler.py was truncated in the listing; request the full source and the absent run.sh to complete your review. Without the full code, there is residual uncertainty. If you want to proceed, recommended safe steps: run the scripts in an isolated environment, provide only the minimal env vars (IMA creds and optionally MINIMAX_API_KEY), inspect or create a run.sh yourself that does not hard-code secrets, and verify openclaw.json is not readable or does not contain extra secrets you don't want the skill to access.