Qinglong Crm Extractor
v1.0.3Automates CRM login, extracts business data and HTML source, and generates structured data reports from CRM pages using Python.
⭐ 0· 465·1 current·1 all-time
byqinlong@pandasun
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Metadata/description: 'Qinglong Crm Extractor' (automates CRM login/extraction). Actual files and SKILL.md implement a simulated 'space-login' demo (SpaceLogin class, moon/mars/ISS simulation). This is a clear mismatch — a CRM extractor should contain CRM integration code, HTTP requests, or API credentials, none of which are present. Also the registry version (1.0.3) disagrees with SKILL.md and README (1.0.0).
Instruction Scope
SKILL.md contains only local usage instructions (install pip deps, copy config.json, run Python). It does not instruct the agent to read unrelated system files or exfiltrate data. However SKILL.md mentions environment variables (SPACE_API_KEY, SPACE_CENTER) that are not declared in the skill metadata, which is an inconsistency to be aware of.
Install Mechanism
No install spec (instruction-only plus included Python files). No network downloads, no package installs specified other than pip -r requirements.txt (requirements.txt is empty). This is low-risk from an installer perspective.
Credentials
Metadata declares no required env vars or credentials. SKILL.md nevertheless references SPACE_API_KEY and SPACE_CENTER — these are not required by the manifest and no justification is provided. The included code does not read environment variables or secrets, so the env mentions appear cosmetic/inconsistent.
Persistence & Privilege
Skill is not always-enabled (always: false) and does not request special system config or persistent privileges. Autonomous model invocation is allowed by default but is not combined with other high-risk factors here.
What to consider before installing
Don't install this expecting a CRM extractor — the package contents implement a simulated "space-login" demo and do not perform CRM login or data extraction. The mismatch could be benign (wrong package metadata) or deliberate mislabeling. Before installing or running: (1) verify the publisher and source (no homepage provided); (2) ask the publisher for the correct CRM extractor artifact or an explanation for the mismatch; (3) inspect the code yourself or run it in an isolated sandbox; (4) never provide real credentials (API keys, CRM passwords) to this package — SKILL.md mentions SPACE_API_KEY but the manifest doesn't require it and the code doesn't use it; (5) if you need a CRM extractor, obtain one whose files and documentation clearly match that purpose and that declares only the credentials it actually needs.Like a lobster shell, security has layers — review code before you run it.
latestvk977mav09syve9sphznvnsyj75828sqx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.