Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Category Link Collector

v1.0.0

采集电商网站分类链接信息,提取分类层级数据并保存为CSV文件。当需要从电商网站分类链接中提取结构化数据时使用此技能。

0· 208·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for qirongzhang/category-link-collector.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Category Link Collector" (qirongzhang/category-link-collector) from ClawHub.
Skill page: https://clawhub.ai/qirongzhang/category-link-collector
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install category-link-collector

ClawHub CLI

Package manager switcher

npx clawhub@latest install category-link-collector
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (collect category links and produce CSVs) matches the actual scripts: functions extract_domain, extract_category_path, parse_category_hierarchy and collect_category_links implement that. However the package hardcodes a user-specific default output directory (/Users/zhangqirong/工作/caiji) in multiple places (SKILL.md, config/settings.json, collect_categories.collect_category_links default). That absolute path is unrelated to the skill's purpose and is surprising for a generic skill.
Instruction Scope
SKILL.md and README describe only local parsing and CSV generation; the runtime instructions do not request any credentials or network access. The code likewise performs purely local parsing and file writes. The only scope concern is the hardcoded default output directory (will write files to /Users/zhangqirong/工作/caiji unless overridden), which is a surprising side-effect but not external exfiltration.
Install Mechanism
There is no install spec (instruction-only from the platform's perspective). Provided code uses standard Python libraries and pandas; nothing is downloaded from arbitrary URLs or installed automatically by the skill bundle.
Credentials
The skill requests no environment variables or credentials (good). But it writes files by default to a fixed absolute path in a particular user's home; this implicit filesystem access is disproportionate to an innocuous parser unless the user explicitly overrides output_dir. The bundle also depends on pandas (declared in SKILL.md).
Persistence & Privilege
always is false and the skill does not request any platform-level persistent privileges. It writes CSV files to disk (its own data), which is normal for this utility. There is no evidence it modifies other skills or system settings.
What to consider before installing
This package appears to do what it says (parse /collections/... URLs into hierarchical CSV rows), but there are several red flags you should consider before installing or running it: - Default output directory: The code and docs hardcode /Users/zhangqirong/工作/caiji as the default output path. Override output_dir on first use or edit config/settings.json to avoid writing files into an unexpected location. - Inconsistencies in packaging: Tests and README/SKILL.md expect different CSV column names and filenames than the implementation actually produces (e.g., tests expect '一级分类' and filenames like example_com.csv, while code produces '1级分类' and filenames like example_com_multilevel.csv). This indicates sloppy packaging and means bundled tests may fail — review/adjust the code or tests before trusting results. - No network calls found: The scripts parse given URLs but do not fetch pages. If you planned to fetch remote pages, the code does not do that; check for additional 'fetch' logic if needed. - Dependencies: Ensure Python 3.x and pandas are installed in a controlled environment before running. - Domains in examples: Example links reference domains like zaraoutlet.top and lulumonclick-eu.shop. Those are only example inputs; the code won't contact them, but double-check any example data you reuse. Recommended actions: run the unit tests locally after fixing the column/filename mismatches or update the test expectations; change the hardcoded default output_dir to a sensible relative or configurable default; inspect and run the scripts in an isolated environment (temporary directory) the first time to confirm behavior. If you plan to integrate this into an agent, ensure the agent won't expose these CSV files to external endpoints (the skill itself does not transmit data externally).

Like a lobster shell, security has layers — review code before you run it.

latestvk97egtq0yjazedbgn8y3bx27y58362df
208downloads
0stars
1versions
Updated 1h ago
v1.0.0
MIT-0

Category Link Collector Skill

功能

  • 从给定的分类链接URL中提取分类信息
  • 解析分类路径,提取一级和二级分类
  • 生成结构化的CSV文件
  • 支持自定义输出目录和文件名

使用方法

基本用法

采集以下分类链接:
https://lulumonclick-eu.shop/collections/women-women-clothes-tank-tops
https://lulumonclick-eu.shop/collections/women-women-clothes-bras-underwear

参数说明

  • 域名变量: 自动从链接中提取域名部分
  • 输出目录: 默认为 /Users/zhangqirong/工作/caiji,可自定义
  • 文件名: 自动使用域名作为文件名(如 lulumonclick-eu.shop.csv

数据结构

生成的CSV文件包含以下列:

  1. 完整链接: 原始分类链接
  2. 分类路径: 从URL中提取的分类路径(如 women-women-clothes-tank-tops
  3. 域名: 网站域名
  4. 1级分类: 提取的一级分类名称(如 Women
  5. 2级分类: 提取的二级分类名称(如 Tank Tops
  6. 3级分类: 提取的三级分类名称(如存在)
  7. 4级分类: 提取的四级分类名称(如存在)
  8. ...: 更多级别分类(根据实际深度动态生成)

多级分类支持

技能现在支持无限级分类提取:

  • 自动识别分类层级深度
  • 动态生成CSV列(1级分类、2级分类、3级分类...)
  • 智能合并特殊词组(T-shirts, Co-ord等)
  • 正确处理数字范围(0-18 months等)

处理逻辑

  1. 从URL中提取域名部分
  2. /collections/ 后提取分类路径
  3. 解析分类路径:
    • 使用智能算法分割分类路径
    • 识别一级分类(Women, Men, Kids, Beauty等)
    • 提取所有级别的下级分类
    • 智能合并特殊词组和数字范围
  4. 根据最大分类深度动态生成CSV列
  5. 生成CSV文件,保存到指定目录

示例

输入链接:

https://lulumonclick-eu.shop/collections/women-women-clothes-tank-tops

输出CSV行:

完整链接分类路径一级分类二级分类域名
https://lulumonclick-eu.shop/collections/women-women-clothes-tank-topswomen-women-clothes-tank-topsWomenTank Topslulumonclick-eu.shop

文件位置

  • Skill主文件: SKILL.md
  • 脚本文件: scripts/collect_categories.py
  • 配置文件: config/settings.json (可选)

依赖

  • Python 3.x
  • pandas 库 (用于CSV处理)

扩展能力

后续可以扩展的功能:

  1. 批量处理多个链接
  2. 支持更多分类层级(三级、四级等)
  3. 自动去重和验证
  4. 支持不同的URL格式
  5. 添加时间戳和采集状态
  6. 集成到自动化工作流中

Comments

Loading comments...