Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Data Sentinel Pro

v1.0.0

7x24 小时监控网页、商品价格、竞对动态,变化即通知。 Use when: 用户需要监控特定网页的变化(价格、内容、状态)。 NOT for: 一次性数据查询,实时聊天。

0· 67·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for anson125chen/data-sentinel-pro-2.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Data Sentinel Pro" (anson125chen/data-sentinel-pro-2) from ClawHub.
Skill page: https://clawhub.ai/anson125chen/data-sentinel-pro-2
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install data-sentinel-pro-2

ClawHub CLI

Package manager switcher

npx clawhub@latest install data-sentinel-pro-2
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (web/page/price monitoring + notifications) matches the code: scripts/monitor.py fetches pages, computes hashes, extracts prices, and sends Telegram/email notifications. However the registry metadata declares no required env vars or config paths while the SKILL.md and the script expect a local config (~/.openclaw/openclaw.json) containing license_key, notification tokens, and email credentials — this mismatch is unexplained.
!
Instruction Scope
SKILL.md instructs adding credentials and configuration to ~/.openclaw/openclaw.json and references storing monitors under ~/.openclaw/workspace/..., but the actual script reads ~/.openclaw/openclaw.json (consistent) and writes per-URL JSON files to ~/.openclaw/data/sentinel (inconsistent with the SKILL.md storage path). The instructions also say to use a 'browser skill' but the shipped script uses requests (server-side fetch) — not harmful but inconsistent. The script will read local config files (potentially containing secrets) and will make outbound calls to monitored URLs and to api.telegram.org when configured.
Install Mechanism
This is an instruction-only skill with a single Python script and no install spec — it doesn't download or execute installers at install time. That is low-risk from an install mechanism perspective.
!
Credentials
The registry lists no required env vars or config paths, yet SKILL.md asks users to place sensitive tokens/credentials (telegram_token, telegram_chat_id, email_user, email_pass, license_key) into a local config file which the script will read. The skill therefore expects access to sensitive credentials but that access was not declared in metadata. Also package.json exists but lists Python packages (requests, beautifulsoup4) — a mismatched metadata file that suggests sloppy packaging or a copy-paste; this inconsistency reduces trust and should be clarified before providing secrets.
Persistence & Privilege
The skill does not request permanent 'always:true' inclusion and does not modify other skills. It will create a local directory (~/.openclaw/data/sentinel) and store per-URL JSON files; it suggests (but does not force) adding cron jobs. These are normal for a monitoring utility and do not indicate elevated privileges.
What to consider before installing
This skill's functionality (fetch page, detect changes, send Telegram/email) is consistent with its description, but there are several red flags you should address before installing or supplying credentials: - Metadata vs runtime mismatch: the registry declares no required env vars/config paths, but SKILL.md and the script expect ~/.openclaw/openclaw.json to hold license_key, telegram_token, email credentials, etc. Treat any credential requests as sensitive and avoid entering real, high-privilege secrets until you verify the source. - Storage path mismatch: SKILL.md documents storing monitors under ~/.openclaw/workspace/..., but the script writes to ~/.openclaw/data/sentinel. Confirm where data and credentials will be stored and back up or inspect those files after installation. - package.json oddity: a Node package.json lists Python libraries (requests, beautifulsoup4). This suggests sloppy packaging or an unreviewed third-party. Prefer installing only after reviewing the repository (the SKILL.md points to a GitHub URL — inspect that repo) or running the script in an isolated environment. - Network behavior: the script will fetch arbitrary URLs you configure and will post notifications to api.telegram.org if a Telegram token is provided. It does not appear to exfiltrate data to unknown endpoints, but because it reads local config and could contain secrets, verify the code yourself or run it in a sandbox. What would increase confidence: a verified repository/source (matching code), updated metadata that declares required config/env vars, correction of the storage-path inconsistencies, and clearer packaging (a requirements.txt or proper packaging for Python rather than package.json). If you cannot verify these, avoid providing real credentials (use a throwaway Telegram bot/chat for testing) and run the script in an isolated account/container.

Like a lobster shell, security has layers — review code before you run it.

latestvk977n76txtyva7pq0sfesrsa79846nrr
67downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Data Sentinel Pro - 全能数据监控专家

Pricing - 定价方案

套餐价格监控 URL检查频率通知方式其他功能
免费版$0/月1 个每天 1 次基础监控
专业版$49/月10 个每 5 分钟Telegram/邮件实时告警、历史记录
企业版$499/月无限每 1 分钟Telegram/邮件/SMS/API专属部署、API 对接、优先支持

升级方式: 联系 ai.agent.anson@qq.com 或访问 https://asmartglobal.com 咨询

When to Run

  • 用户说"监控这个页面""盯住这个商品""价格变了通知我"
  • 通过 cron 设置的定时任务(每 5 分钟/每小时)
  • 批量添加监控任务时

Workflow

  1. 解析用户提供的监控目标 URL 和监控规则
  2. 使用浏览器技能获取页面内容
  3. 提取目标数据(价格、文本、特定元素)
  4. 与上次记录的值对比
  5. 如果有变化,通过 Telegram/邮件发送警报
  6. 记录最新值到本地存储

How to Use

监控商品价格:

@openclaw 盯住这个商品 https://item.jd.com/123456.html 价格低于 1000 通知我

监控网页内容变化:

@openclaw 监控 https://news.ycombinator.com 标题前 5 条有变化就通知

查看已监控列表:

@openclaw 我的监控列表

Configuration

~/.openclaw/openclaw.json 中添加:

{
  "skills": {
    "data-sentinel-pro": {
      "license_key": "<YOUR_LICENSE_KEY>",
      "plan": "free|pro|enterprise",
      "notification": {
        "telegram_token": "<YOUR_TELEGRAM_BOT_TOKEN>",
        "telegram_chat_id": "<YOUR_CHAT_ID>",
        "email_smtp": "smtp.qq.com",
        "email_user": "<YOUR_EMAIL>",
        "email_pass": "<YOUR_EMAIL_AUTH_CODE>"
      },
      "check_interval": 300,
      "max_urls_per_user": 10
    }
  }
}

⚠️ 安全提示: 不要将真实凭据提交到版本控制!使用环境变量或本地配置文件。

Scripts

执行监控任务:

# 手动执行一次检查(核心脚本)
uv run scripts/monitor.py <url> [rule]

# 示例:监控价格变化
uv run scripts/monitor.py https://item.jd.com/123456.html price

# 示例:监控内容变化
uv run scripts/monitor.py https://example.com content

💡 提示:完整任务管理(添加/删除/状态)通过 OpenClaw 主程序处理,此脚本用于手动检查。

Storage

监控数据存储在 ~/.openclaw/workspace/data-sentinel-pro/monitors.json

格式:

{
  "tasks": [
    {
      "id": "task_001",
      "url": "https://example.com/product",
      "selector": ".price",
      "condition": "price < 1000",
      "lastValue": "1299",
      "lastCheck": "2026-03-20T10:00:00Z",
      "notifyVia": ["telegram", "email"],
      "created": "2026-03-20T09:00:00Z"
    }
  ]
}

Notification Templates

价格下降:

🔔 价格提醒!
商品:{product_name}
原价:¥{old_price}
现价:¥{new_price}
降幅:{discount}%
链接:{url}

内容变化:

📄 页面更新提醒!
URL: {url}
变化时间:{time}
变化内容:{diff_summary}

Subscription Management

查看订阅状态:

@openclaw 查看我的 Data Sentinel 订阅

升级套餐:

@openclaw 升级到专业版
@openclaw 升级到企业版

取消订阅:

@openclaw 取消 Data Sentinel 订阅

Support

Comments

Loading comments...