区块城市
v1.2.0BlockCity区块城市数据获取Skill，支持从排名页获取城市排名、居民人数、开启区块数，从城市详情页获取基金余额、剩余人气值等信息
⭐ 0· 93·0 current·0 all-time
bybittao@hgta23
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the code and docs: the package scrapes ranking and detail pages on blockcity.vip and provides parsing, caching, and mock fallbacks. All declared functionality (ranking, population, blocks, fund balance, popularity, mayor info) is present in code/docs.
Instruction Scope
SKILL.md and README instruct the agent to fetch and parse pages on blockcity.vip using requests/BeautifulSoup or Playwright; they do not ask the agent to read unrelated files, environment variables, or send data to third-party endpoints beyond blockcity.vip (aside from a promotional link). Parsing logic and fallback/mock behavior are explained. No scope-creeping file reads or unrelated network destinations are present.
Install Mechanism
This is an instruction-only skill with requirements.txt but no automated installer. requirements.txt includes playwright (a heavy dependency that can download browser binaries and increase runtime footprint). setup.py's install_requires omits playwright (inconsistency). Installing via pip is straightforward, but Playwright may require additional setup (playwright install) and will increase surface area.
Credentials
The skill requests no environment variables, credentials, or config paths. Its network use (outbound HTTP(S) to blockcity.vip) is proportional to its scraping purpose. There are no unexpected secret-named env vars or access requests.
Persistence & Privilege
It does not request always:true and will not be auto-forced into every agent. There is no code that modifies other skills or global agent configuration. Its cache is internal to the instance and does not alter system-wide settings.
Assessment
This skill appears to do exactly what it claims: scrape blockcity.vip for city rankings and details. Before installing, consider: (1) the requirements include Playwright (in requirements.txt) which is optional in the code but can download browser binaries and increase attack surface—only install it if you need full JS-rendering; (2) the package contains an affiliate/promo link—be aware of the owner’s commercial interest; (3) scraping makes outbound HTTP requests to blockcity.vip—run in an environment where outbound network activity is acceptable and respect the target site's terms and rate limits; (4) the parsing is fragile (regex/heuristics) so verify results for your use case. If you need stronger assurance, review the full blockcity_skill.py file locally or run it in a sandboxed environment/VM before granting it network access.Like a lobster shell, security has layers — review code before you run it.
latestvk97acc99387h73ngf5szqe2h1d849we2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.