文旅素材搜索
v1.0.18指导智能体检索文旅素材（数游神州 data0086.com）并走通「搜索 → 列表 → 预览(HLS/MP4) → 选择/购买 → Mock交易返回 → 视频下载到本地」。搜索请求默认 3条，最多 5 条（pageSize≤5），用户可要求更少；列表用表格展示（颜色徽章状态 + img + video），用户通过...
⭐ 0· 189·0 current·0 all-time
byF1@fengyily
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the included SKILL.md, API docs, and helper scripts: the skill searches data0086.com, renders results, and (on explicit purchase) downloads media to downloads/. One small inconsistency: top-level registry metadata reported no required binaries, while .well-known/agent-skills/index.json and scripts declare python3 as required (and ffmpeg optional) — the scripts will fail without python3 and may need ffmpeg for HLS. Otherwise required resources (trusted domains, download dir) align with the purpose.
Instruction Scope
Runtime instructions explicitly direct the agent to call the platform search API, render HTML/Markdown, and—when the user issues a purchase command—construct a mock response and run bash scripts to download media into downloads/. The SKILL.md documents the media-origin checks and that preview/search do not write files. This is in-scope for the stated functionality, but the instructions do require executing shell scripts and network downloads on explicit user purchase, which users should understand and consent to.
Install Mechanism
No install spec (instruction-only skill) — files are shipped with the skill. There is no remote download/install step. The included bash scripts use standard tools (python3, curl, ffmpeg) but do not fetch arbitrary code at install time.
Credentials
The skill declares no mandatory secrets or credentials. Two optional env vars (WENLV_API_ORIGIN to add a trusted origin, TRADE_API_BASE to enable real ordering) are documented and plausible. No unrelated credentials or broad environment access are requested.
Persistence & Privilege
always:false and agent-autonomy defaults are preserved. The skill writes files only to its downloads/ directory and only after an explicit user purchase command; it invokes local shell scripts to do so. This behavior is consistent with the stated purpose but is a persistent filesystem side effect that users should be aware of.
Assessment
This skill appears to do what it says: search the data0086.com catalog, show results, and (on explicit purchase) download preview/full media to a downloads/ folder. Before installing or using it, consider: 1) The skill will run local shell scripts (bash scripts/download_video.sh) and requires python3 (and ffmpeg for HLS) — ensure those exist and you trust running them. 2) Downloads are performed only after you issue a purchase command, and files are saved under the skill root downloads/ directory; be prepared for large files and ensure you want files written locally. 3) Check config.json.trusted_media_origins — the script only allows downloads from these domains (or the domain you set via WENLV_API_ORIGIN); if you override WENLV_API_ORIGIN you are expanding the trusted list. 4) If you later set TRADE_API_BASE, the skill will call a real order API instead of using the current mock flow — only set that if you trust the endpoint and credentials. 5) Minor metadata mismatch: the registry top-level said no required binaries while index.json and the scripts require python3; verify environment consistency before running. If any of the above is unacceptable, do not enable the skill or review/modify the scripts before use.Like a lobster shell, security has layers — review code before you run it.
latestvk9711rge07e9nc6brgtk8hjf7x84wy8j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.