极空间迅雷下载

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used with the wrong magnet link or an unexpected page state, the agent could create an unintended download task.

Why it was flagged

The skill directs the agent to use browser automation commands to click through the ZSpace/Xunlei UI, type the magnet link, and start the download. This is purpose-aligned, but it is still real automated interaction with a web account.

Skill content

openclaw browser snapshot | grep ... | xargs openclaw browser click ... openclaw browser type {} "<magnetUrl>" ... ref=...: 立即下载

Recommendation

Use it only with magnet links you intentionally provide, and verify the ZSpace page before and after the workflow runs.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The agent can perform the documented download-task creation as the logged-in ZSpace user.

Why it was flagged

The workflow relies on the user's logged-in ZSpace browser session. That is expected for this integration, but it means the agent operates with the user's account privileges for the download task.

Skill content

用浏览器打开极空间网站（https://www.zconnect.cn），如果未登录，则要求用户先在浏览器完成登录后再重新执行。

Recommendation

Make sure the browser is logged into the intended ZSpace account and avoid running the skill on shared or unintended sessions.