Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
微信文章格式转换
v1.0.0微信公众号文章抓取与转换,支持 Markdown/HTML/Text/JSON/Excel 五种格式。 触发条件:用户发送微信文章链接(https://mp.weixin.qq.com/s/xxx)、 多链接(换行分隔)、或「帮我转这篇文章」「保存微信文章」等表达。 格式选择前必须询问用户,支持单选或多选。
⭐ 1· 53·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description match the included scripts: fetch_article.py and batch_fetch.py implement fetching mp.weixin.qq.com articles and saving Markdown/HTML/Text/JSON/Excel. The code saves output to the user's Desktop as described. However, SKILL.md lists only html5lib as a dependency while the code imports bs4 (BeautifulSoup) and likely uses additional libraries for Excel output — a missing dependency declaration is an inconsistency.
Instruction Scope
Instructions and scripts confine activity to fetching articles and saving converted files, and they require asking the user for output format first as stated. But the implementation will download every asset URL found in article HTML (CSS, images, background URLs) with no domain restriction; that means the tool can make requests to arbitrary hosts (including internal network addresses) if such URLs are embedded in the article.
Install Mechanism
There is no install spec (instruction-only), but code files are included. The SKILL.md declares html5lib only; the code imports bs4 (beautifulsoup4) and probably an Excel library (not declared). The lack of explicit dependency/install instructions is a coherence/operational gap: users may have to install packages manually and may unknowingly install from unvetted sources.
Credentials
The skill requests no environment variables, no credentials, and no config paths. File writes are limited to user-controlled output directories (~/Desktop/...), which aligns with the stated purpose.
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence. Autonomous invocation is allowed (platform default) but there are no additional privilege escalations in the package.
What to consider before installing
What to consider before installing:
- Functional coherence: The scripts do what the description says (download article HTML and assets, convert and save). However SKILL.md lists only html5lib while the code imports BeautifulSoup (bs4) and likely an Excel library — confirm and install required Python packages (beautifulsoup4, html5lib, and the Excel writer such as openpyxl/xlsxwriter) from trusted sources before running.
- Network safety: The tool downloads all asset URLs it finds in the article HTML without domain restriction. A malicious or crafted article could include links to internal network addresses (127.0.0.1, 192.168.x.x) or other unexpected hosts; consider running the tool in a network-restricted or sandboxed environment if you are concerned about internal service access.
- Filesystem impact: It writes output under your home Desktop by default. If you allow it, it will create directories and save binary assets — review the save location and run in a directory you control.
- Code review/validation: Review the rest of fetch_article.py (the truncated portion) and save_article implementation to confirm there is no telemetry, hidden remote endpoints, or unexpected behavior (e.g., uploading files elsewhere). The provided excerpts show no evidence of exfiltration, but the file is truncated so complete review is recommended.
- Safe testing: Run first on a single, benign article in an isolated environment; inspect downloaded assets and logs to confirm behavior before bulk use.
If you want, I can: (1) list precise Python packages this code requires by scanning the rest of fetch_article.py, (2) extract and show the save_article function and Excel code for review, or (3) suggest command-line steps to create a safe virtualenv and run one test fetch.Like a lobster shell, security has layers — review code before you run it.
latestvk979bn3fx1ftzh0vgpz8ydjpsh84ppmn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
