Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Share to GetNote

v1.0.2

Parse ChatGPT or Gemini shared conversation links and save Q&A pairs as notes to GetNote (biji.com). Use when user provides a ChatGPT or Gemini share link an...

0· 15·0 current·0 all-time
byHypnos@silentforce
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description (import shared ChatGPT/Gemini conversations to GetNote) align with the provided script and SKILL.md: parse a share URL and pass Q&A pairs to the getnote skill for saving. However, the registry metadata lists no required environment variables or config paths while SKILL.md explicitly requires GetNote authorization (GETNOTE_API_KEY and GETNOTE_CLIENT_ID or ~/.openclaw/openclaw.json). That mismatch suggests the declared metadata is incomplete.
Instruction Scope
SKILL.md confines runtime behavior to: validate a share URL, ensure uv is available, run the parse_share.py script (which loads the share page with Playwright and extracts alternating user/assistant messages), present parsed notes to the user for confirmation, then call the getnote skill's /note save to persist notes. The fallback (manual extraction via browser-agent snapshot) still stays within the stated purpose. The instructions do require visiting user-provided share URLs and loading their contents, which is expected for this task.
Install Mechanism
No install spec in registry (instruction-only), but the script depends on Playwright and expects uv to install it at runtime. Playwright will download browser binaries (Chromium) when first used — this writes files to disk and performs network downloads. This is proportional to the task but is a non-trivial operation and should be documented in the metadata (currently it is not).
!
Credentials
The SKILL.md requires GetNote credentials (GETNOTE_API_KEY and GETNOTE_CLIENT_ID) or a local OpenClaw config file to be present; the registry metadata reports no required env vars or config paths. Requesting GetNote credentials is reasonable for saving notes, but the missing declaration is a mismatch and a transparency problem. Also note that running the skill will load arbitrary shared conversation pages (user-provided), which may contain sensitive content; the skill will forward that content to the configured getnote service via the getnote skill.
Persistence & Privilege
always is false and the skill does not request permanent/autonomous-on-every-run presence. It invokes the getnote skill but does not modify other skills or system-wide settings. Autonomous invocation is allowed by default — combined with the previous concerns (undisclosed credential requirements), exercise caution but there are no abnormal privilege requests in the manifest.
What to consider before installing
This skill appears to do what it says: it loads a ChatGPT/Gemini share URL, extracts Q&A turns with Playwright, and then saves them to GetNote via the getnote skill. Before installing, consider: 1) Metadata mismatch: the SKILL.md requires GETNOTE_API_KEY / GETNOTE_CLIENT_ID or ~/.openclaw/openclaw.json, but the registry metadata lists no required environment variables or config paths — ask the publisher to correct the manifest or confirm why credentials are not declared. 2) Runtime behavior: the script uses Playwright which will download browser binaries and render the share page (executing page JS). That is expected for parsing but is a heavier runtime action — run in a sandbox if you are unsure. 3) Data exposure: parsed conversation contents will be sent to the getnote skill (and thus to your GetNote account) — ensure you trust the GetNote integration and have authorised it intentionally. 4) If you rely on auto-triggering, be aware the agent will visit any matching share URL provided by the user; if you prefer, only run the skill on explicit user command after reviewing extracted notes. If you want higher confidence, request that the publisher update registry metadata to declare required env vars/config paths and provide a full, untruncated script for review.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fst58qd0ejw19a3av98fq8h844e0q

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Share to GetNote

将 ChatGPT 或 Gemini 的公开分享对话导入为 Get 笔记。每轮问答生成一条独立笔记(问题为标题,回答为正文 MD 格式)。

触发条件

当用户提供的 URL 匹配以下模式时自动触发:

  • https://chatgpt.com/share/*
  • https://chat.openai.com/share/*
  • https://gemini.google.com/share/*
  • https://g.co/gemini/share/*

前置依赖

运行环境

需要 uv (Python 包管理器) 。脚本使用 PEP 723 内联依赖声明,uv run 会自动安装所需的 playwright 包。

检查 uv 是否可用:

uv --version

若未安装 uv,参考: https://docs.astral.sh/uv/getting-started/installation/

GetNote Skill

需要 getnote skill 已安装并完成授权。检查方式:确认环境变量 GETNOTE_API_KEYGETNOTE_CLIENT_ID 已设置,或 ~/.openclaw/openclaw.json 配置文件存在。

若未配置,提示用户:

请先运行 /note config 完成 GetNote 授权配置。

getnote skill 安装地址: https://clawhub.ai/iswalle/getnote

核心工作流

Step 1: 验证 URL

确认用户提供的 URL 匹配支持的分享链接格式。若不匹配,告知用户支持的格式。

Step 2: 检查运行环境

确认 uv 可用。若不可用,告知用户安装方法。

Step 3: 运行解析脚本

执行解析脚本提取对话内容(脚本首次运行时会自动安装 Playwright 和 Chromium)。

SKILL_DIR 为本 SKILL.md 文件所在的目录,请根据实际安装路径替换:

uv run SKILL_DIR/scripts/parse_share.py "<share_url>"

脚本输出 JSON 数组到 stdout:

[
  {"title": "[1/3] 问题文本...", "content": "回答的 markdown 内容...\n\n---\n*来源: ...*"},
  {"title": "[2/3] 第二个问题...", "content": "第二个回答..."}
]

Step 4: 展示结果并确认

解析 JSON 输出后,向用户展示:

成功提取 N 条笔记:
1. [标题1]
2. [标题2]
...

是否保存到 GetNote?

等待用户确认后继续。

Step 5: 保存到 GetNote

逐条调用 getnote skill 的 /note save 命令保存笔记。对于每条笔记:

  • 标题: JSON 中的 title 字段
  • 正文: JSON 中的 content 字段(markdown 格式)

每保存成功一条,报告进度。

Step 6: 汇报结果

保存完成后,向用户汇报:

已成功保存 N/M 条笔记到 GetNote。
[如有失败] 以下笔记保存失败:
- [标题]: [错误原因]

错误处理

脚本退出码含义处理方式
1URL 不支持告知用户支持的 URL 格式
2页面加载失败/超时提示链接可能已过期、已删除或需要登录
3未找到对话数据提示页面结构可能已变更,建议使用备用方案
4Playwright 未安装引导用户安装 Playwright

备用方案

当 Python 脚本失败时(如页面结构变更),使用以下备用流程:

  1. 使用 browser-agent Task 工具打开分享链接
  2. 等待页面加载完成后截取文本快照
  3. 从快照文本中手动识别和提取 Q&A 对(用户消息和助手回复交替出现)
  4. 按照相同格式组织为 {title, content} 结构
  5. 继续 Step 4(确认)和 Step 5(保存)

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…