Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: index.js fetches top lists from Weibo/抖音/头条/百度/知乎/腾讯, writes hot-data.json; format.js clusters and formats results. No unrelated services, binaries, or secrets are requested.
Instruction Scope
SKILL.md instructs running the two scripts and sending formatted stdout to a messaging tool (Feishu). The scripts only read/write the declared hot-data.json and perform scraping and local clustering; they do not instruct reading other system files or environment variables.
Install Mechanism
No install spec; both scripts use only Node.js built-ins (https, fs, zlib, path, url). There are no downloads from third‑party URLs or extracted archives. Risk is limited to executing provided JS with node.
Credentials
Skill requests no environment variables or credentials. One small mismatch: SKILL.md expects a 'message' tool to send output to Feishu (action=send, channel=feishu) but the skill does not declare Feishu credentials — this is likely intentional because messaging is provided by the host platform, but you should confirm the platform's message tool will behave as expected and that you trust the destination channel.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent agent-level privileges or modify other skills. Autonomous invocation is allowed by default but not combined with other risky privileges here.
Assessment
This skill is coherent with its description: it scrapes several public hot‑list pages, clusters titles locally, and formats a short markdown summary. Before installing, consider: (1) it executes Node.js code — review or run the scripts in a sandbox if you don't trust the author; (2) scraping can trigger site rate limits or violate terms of service—ensure you comply; (3) the SKILL.md expects the host to send the markdown to Feishu via a messaging tool — verify which account/channel will receive messages; and (4) the scripts filter out some political content and perform simple HTML/JSON parsing that may break if sites change. If those points are acceptable, the skill appears internally consistent.Like a lobster shell, security has layers — review code before you run it.
latestvk9760yhbgpcn496gt4d35rk8n1843wft
License
MIT-0
Free to use, modify, and redistribute. No attribution required.