Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MGTV

v1.0.2

搜索芒果 TV 视频资源并在系统浏览器中播放

1· 170·0 current·0 all-time
bymgtv@kllb520

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kllb520/mgtv.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "MGTV" (kllb520/mgtv) from ClawHub.
Skill page: https://clawhub.ai/kllb520/mgtv
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mgtv

ClawHub CLI

Package manager switcher

npx clawhub@latest install mgtv
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (search Mango TV and open playback pages) aligns with the included scripts. The script requires only Node and makes HTTPS calls to Mango TV search API (mobileso.bz.mgtv.com) and spawns a platform-specific command to open the system browser — all expected for this functionality.
Instruction Scope
SKILL.md and the scripts instruct running node scripts/search-mgtv.js with --query or --direct-url; the runtime code only performs HTTP GETs to the Mango TV API, selects a URL, and opens the browser (or prints a link in headless environments). No unrelated files, credentials, or external endpoints are accessed. Minor docs drift: some documentation mentions an optional BROWSER_COMMAND env var and suggests installing Playwright for automation, but the shipped main script does not read BROWSER_COMMAND nor depends on Playwright in package.json.
Install Mechanism
There is no automated install spec (instruction-only install). The package includes code files and a package.json but no declared dependencies. README/USAGE suggest 'npm install playwright' for advanced automation — this is optional and not required by the main script; installing Playwright would download large browser binaries (as the CHANGELOG correctly noted they removed a playwright dependency).
Credentials
The skill declares no required environment variables or credentials. The script does read common environment indicators (HEADLESS, CI, DISPLAY, ELECTRON_RUN_AS_NODE) to decide whether to try to open a browser or just print a link — this is proportional to the stated behavior and not sensitive. No secrets or unrelated env vars are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configuration, and does not persist credentials. It spawns a short-lived process to open the browser and exits — no elevated or persistent privileges requested.
Assessment
This skill appears to do exactly what it says: it queries Mango TV's public search API and opens the resulting page in your system browser (or prints a link if running in headless/CI). It requires Node and outbound HTTPS access but asks for no secrets. Notes before installing: 1) documentation mentions Playwright and an optional BROWSER_COMMAND, but the main script does not depend on Playwright nor read BROWSER_COMMAND — do not install heavy dependencies (like Playwright) unless you need the advanced automation features; 2) review the small scripts yourself (they are included) before running code from an unknown source; 3) the script will spawn platform commands (open/xdg-open/cmd start) which will open browser windows if run locally — avoid running it on servers where you don't want GUI operations. Overall coherent and proportionate to its purpose.
scripts/search-mgtv.js:224
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📺 Clawdis
Binsnode
latestvk975egq928w21a1zwcvpdny46584x9c0
170downloads
1stars
3versions
Updated 1w ago
v1.0.2
MIT-0

MGTV - 芒果 TV 视频搜索与播放

功能说明

此 skill 用于搜索芒果 TV 视频资源,并在系统默认浏览器中打开播放页面。

何时使用

当用户请求:

  • 搜索芒果 TV 的视频(综艺、电视剧、电影、动漫等)
  • 播放芒果 TV 的节目
  • 打开芒果 TV 网站
  • 查找特定的芒果 TV 内容
  • 打开芒果 TV 视频链接

使用示例

搜索视频

用户:"我想看《乘风破浪的姐姐》"
→ 在浏览器中打开芒果 TV 搜索页面

用户:"播放芒果 TV 的《歌手 2024》"
→ 搜索并打开相关视频

用户:"帮我找一下《大侦探》最新一期"
→ 打开搜索结果页面

直接打开链接

用户:"打开这个芒果 TV 视频:https://www.mgtv.com/b/xxx/xxx.html"
→ 直接在浏览器中播放视频

用户:"打开芒果 TV 首页"
→ 打开 mgtv.com

使用方法

命令行

# 搜索视频
node scripts/search-mgtv.js --query "节目名称"

# 直接打开 URL
node scripts/search-mgtv.js --direct-url "https://www.mgtv.com/b/xxx/xxx.html"

参数说明

  • --query: 搜索关键词(必填,用于搜索)
  • --direct-url: 直接打开的视频 URL(用于已知链接时)

脚本说明

scripts/search-mgtv.js

主要脚本,功能:

  1. 解析命令行参数
  2. 构建芒果 TV 搜索 URL 或使用提供的 URL
  3. 调用系统命令在浏览器中打开

支持的操作系统:

  • macOS: 使用 open 命令
  • Windows: 使用 start 命令
  • Linux: 使用 xdg-open 命令

注意事项

  1. 网络连接:需要能够访问芒果 TV 网站
  2. 浏览器:系统需要有默认浏览器
  3. VIP 内容:部分视频需要芒果 TV 会员账号
  4. 搜索精确度:使用完整节目名称效果更好

故障排除

浏览器无法打开

  • 确认系统有相应的命令(macOS: open, Windows: start, Linux: xdg-open)

搜索无结果

  • 使用更精确的节目名称
  • 检查网络连接

视频无法播放

  • 清除浏览器缓存
  • 检查是否需要登录 VIP 账号

测试

# 运行测试套件
node scripts/test.js

# 单个测试
node scripts/search-mgtv.js --query "歌手"

文件结构

mgtv/
├── SKILL.md           # Skill 定义(本文件)
├── README.md          # 详细文档
├── USAGE.md           # 使用指南
├── package.json       # 项目配置
├── .gitignore         # Git 忽略文件
├── .clawhubignore     # Clawhub 忽略文件
└── scripts/
    ├── search-mgtv.js # 主脚本
    └── test.js        # 测试脚本

许可证

MIT License


免责声明:本 Skill 仅供学习交流使用,请支持正版视频内容。

Comments

Loading comments...