B站推送附件

获取B站Top20榜单，提取标题、摘要和链接。

Security Scan

The skill's code matches its stated purpose (fetching B站 Top20) but the package metadata omits required runtimes/dependencies and has no install steps — this mismatch is unexpected and worth review before installing.

Purpose & Capability

The skill name/description and included code (index.js + bili_fetcher.py) are coherent: they fetch B站 Top20 via the official Bilibili API and extract title/summary/link. However the registry metadata lists no required binaries or environment variables even though the implementation requires a Node.js runtime (to register the tool) and a Python runtime with the 'requests' library. That omission is a meaningful inconsistency.

Instruction Scope

SKILL.md instructs the agent to dispatch a local tool (bili_fetch_tool). The tool's implementation only runs a local Python script and issues an HTTPS GET to api.bilibili.com. The instructions do not read arbitrary files, request unrelated environment variables, or post data to unknown external endpoints.

Install Mechanism

There is no install spec despite included code that must run. The skill will require Node.js and Python on PATH and the Python 'requests' package installed; none of this is declared or installed automatically. Missing install steps increase the chance of runtime failure or ad-hoc manual fixes that a user might do incorrectly.

Credentials

The skill declares no environment variables or credentials and the code does not attempt to read secrets or other environment values. Network access is limited to the Bilibili public API endpoint, which is proportional to the stated purpose.

Persistence & Privilege

The skill is not forced always-on (always: false) and does not request elevated privileges or attempt to modify other skills or system-wide configuration. It runs on-demand as a tool via exec; autonomous invocation defaults apply but are not an additional red flag here.

What to consider before installing

This skill appears to do what it says (call Bilibili's ranking API and print top 20 entries), but the manifest omits runtime requirements. Before installing or enabling it: 1) Verify you are willing to run bundled code from this unknown source. 2) Ensure your agent environment has Node.js and a Python interpreter available, and install the Python 'requests' package (pip install requests) or update the skill to declare/install that dependency. 3) Consider running the code in a sandbox or review/modify index.js to use a more robust spawn invocation (avoid shell injection risks) and call 'python3' explicitly if needed. 4) If you need higher assurance, ask the publisher for an install spec or source provenance; the omission of declared binaries/deps is why this is flagged as suspicious.

技能介绍

这是一个遵循 OpenClaw 标准 Tool 插件架构的 B 站热榜抓取模块，底层通过 Node.js Bridge 唤起 Python 自动化脚本

更新日志 (v1.2.0)

• 修复了Windows环境下终端输出特殊字符（如Emoji）导致的GBK编码报错问题，强制采用UTF-8输出。遵循了openclaw3.23.2版本规范进行了修改
• 遵循了openclaw3.23.2版本规范进行了修改