Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

html-publisher

v1.0.1

将 HTML 内容发布为在线网页并返回可访问的 URL。当用户想把 HTML 发布上线、生成分享链接、或需要把网页内容转为公开 URL 时调用。

0· 76·0 current·0 all-time
byAIconductor@huyi9531

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for huyi9531/html-publisher.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "html-publisher" (huyi9531/html-publisher) from ClawHub.
Skill page: https://clawhub.ai/huyi9531/html-publisher
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install html-publisher

ClawHub CLI

Package manager switcher

npx clawhub@latest install html-publisher
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The SKILL.md explicitly requires running a 'gnomic' CLI to upload HTML, but the skill metadata lists no required binaries and provides no install spec. Declaring no binaries is inconsistent with the stated purpose of invoking gnomic.
!
Instruction Scope
Instructions tell the agent to read local HTML files and run 'gnomic content html2url' which will upload content to a remote service and return a public URL. That matches the stated purpose, but the exact remote endpoint/service is not defined (example URL uses ts.fyshark.com), so it's unclear what external host will receive the content. Reading local files is expected, but uploading arbitrary HTML (possibly sensitive) to an unknown public endpoint is a privacy risk.
!
Install Mechanism
There is no formal install spec, yet the doc suggests installing 'gnomic-cli' globally via 'npm install -g gnomic-cli' and links to a GitHub repo. Installing an npm package globally executes third‑party code; the skill should have declared this dependency or provided a vetted install spec. The npm package source and maintainer were not validated in the skill metadata.
Credentials
The skill requests no environment variables, credentials, or config paths, which is proportionate to an instruction-only publisher that uses a local CLI and uploads data. No unexplained secrets are requested.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent privileges or system-level configuration changes in the metadata.
What to consider before installing
This skill is instruction-only but depends on a third-party CLI (gnomic/gnomic-cli). Before installing or using it: 1) Verify the npm package name and author and review the gnomic-cli source on GitHub to ensure it's trustworthy. 2) Understand that running the commands will upload whatever HTML you provide to a remote host (example URL uses ts.fyshark.com) — do not publish sensitive content. 3) Prefer testing with non-sensitive dummy pages first. 4) If you need stronger guarantees, install gnomic-cli in a sandbox or inspect its code locally rather than running a global npm install. 5) Consider asking the skill author/source for clarification about which service/endpoint is used for hosting and for an install spec that the skill metadata should declare.

Like a lobster shell, security has layers — review code before you run it.

latestvk9715jyedkvywm09v6jre6mzwd842vr3
76downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

HTML 网页发布指南

能力说明

通过 gnomic CLI 工具,可以将任意 HTML 代码发布为一个在线可访问的网页,并返回公开 URL。适用于:

  • 快速分享生成的 HTML 页面
  • 将本地 HTML 文件发布上线
  • 把 AI 生成的网页内容转为可访问链接

使用方式

基本命令

从文件读取(推荐,适用于所有 shell):

gnomic content html2url --file <html文件路径>

直接传入 HTML 字符串(适用于短 HTML):

gnomic content html2url "<h1>Hello World</h1>"

输出格式

默认返回 JSON(适合 AI Agent 解析):

{
  "success": true,
  "data": {
    "url": "https://..."
  }
}

-f text 参数返回人类可读格式:

gnomic content html2url --file index.html -f text

输出示例:

Published successfully!
URL: https://ts.fyshark.com/html_files/document_xxx.html

操作流程

第一步:准备 HTML 内容

获取需要发布的 HTML 内容,可以是:

  • 用户提供的 HTML 代码
  • AI 生成的完整 HTML 页面
  • 读取本地 HTML 文件内容

第二步:执行发布命令

推荐方式:使用 --file 选项从文件读取

这是最可靠的方式,避免 shell 参数分割问题:

gnomic content html2url --file index.html

备选方式:直接传入 HTML 字符串

适用于简短的 HTML 片段:

gnomic content html2url "<h1>Hello World</h1>"

注意:大段 HTML 字符串在 PowerShell 中可能因空格被分割成多个参数,导致报错。优先使用 --file 方式。

第三步:获取 URL

从返回的 JSON 中提取 data.url 字段,即为可访问的在线网页地址。


注意事项

  • HTML 内容越大,发布耗时越长
  • 返回的 URL 为公开链接,任何人均可访问
  • 不支持动态后端逻辑,仅支持静态 HTML/CSS/JS
  • 如果 HTML 中引用了外部资源(图片、字体等),需确保这些资源本身可公开访问

补充:命令不可用时

如果执行 gnomic 命令时提示找不到命令,说明 gnomic-cli 尚未安装,执行以下命令安装:

npm install -g gnomic-cli

gnomic-cli开源地址:https://github.com/huyi9531/gnomic_cli

Comments

Loading comments...