Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Save Article Miaoyan

v2.0.0

文章自动保存到 Miaoyan。抓取任意网页文章(微信、博客、技术文章等),生成摘要,保存为 Markdown 到 Miaoyan/待学习 文件夹。Use when user wants to save an article/webpage to Miaoyan notes.

0· 121·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vlalamoon/save-article-miaoyan.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Save Article Miaoyan" (vlalamoon/save-article-miaoyan) from ClawHub.
Skill page: https://clawhub.ai/vlalamoon/save-article-miaoyan
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install save-article-miaoyan

ClawHub CLI

Package manager switcher

npx clawhub@latest install save-article-miaoyan
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description match the code's purpose (fetch article → generate summary → save Markdown to Miaoyan iCloud folder). However the SKILL.md/README require a Tavily API key while the registry metadata lists no required env vars — an inconsistency. The hardcoded MIAOYAN_DIR and references to a specific user path (/Users/andy/...) are user-specific and reduce portability but are explainable for a local note-saving tool.
!
Instruction Scope
SKILL.md/README state '不上传到任何云服务' (no upload to cloud), but the code explicitly calls external services: Jina (r.jina.ai via curl) and Tavily API (https://api.tavily.com/extract). That contradicts the privacy claim and expands scope to sending article content off-device. TRIGGER.md also instructs automatic high-priority execution on detecting WeChat links (immediate save without explicit user confirmation), which is a behavioral decision users should be aware of.
Install Mechanism
No install spec; it's instruction- and script-based using local Python and curl. No remote archive downloads or package installs are used. Scripts run subprocesses (curl) which is expected for a fetcher.
!
Credentials
The code reads TAVILY_API_KEY from the environment and will POST URLs/content to Tavily if used; SKILL.md lists this key as '必需配置' but the skill registry metadata declared no required env. Requesting an API key for an external extractor is proportionate only if the user understands external processing. No other secrets are requested.
Persistence & Privilege
always:false (normal). The TRIGGER.md/auto_save mechanism is set up to auto-run on detected messages with high priority and no confirmation; while the skill does not force-enabled in every agent run, its auto-trigger behavior means it can run without per-message confirmation — consider this a behavior/privacy risk rather than a platform privilege escalation.
What to consider before installing
Key points to consider before installing: - Privacy contradiction: the README/SKILL.md claim article content is saved only locally, but the scripts call external APIs (r.jina.ai and api.tavily.com). That means article text may be transmitted to third-party services — remove or disable those calls if you need strict local-only handling. - Metadata mismatch: the skill manifest claims no required env vars, but SKILL.md and the code expect TAVILY_API_KEY. Treat Tavily as an optional but privacy-impacting dependency; verify whether you must provide an API key and whether you trust the service. - Automatic behavior: TRIGGER.md sets automatic high-priority execution on detecting WeChat article links and the provided trigger script runs without user confirmation. If you want manual control, modify the trigger to require confirmation before invoking the save script. - Filesystem effects: the script writes to a hardcoded iCloud path (/Users/andy/Library/.../Miaoyan). Confirm the path is correct for your machine and that you are comfortable with the skill writing files there. Consider changing MIAOYAN_DIR to a safer/test directory while evaluating. - Code review recommendations: inspect the calls to fetch_with_jina and fetch_with_tavily and either remove them or gate them behind an explicit opt-in. If you need offline-only operation, remove those network calls and rely purely on local HTML fetch/parsing. Also consider adding logging controls and explicit user prompts. - If unsure: test in a sandbox or throwaway account, or ask the author to clarify why the README claims 'no cloud upload' while the code uses external extractors. The discrepancies make this skill suspicious but not obviously malicious.

Like a lobster shell, security has layers — review code before you run it.

latestvk972985dpnp93esfwzz0687awh83gmwh
121downloads
0stars
4versions
Updated 1mo ago
v2.0.0
MIT-0

Save Article to Miaoyan

自动抓取任意网页文章,生成摘要,保存到 Miaoyan 笔记应用。

支持的链接类型

  • ✅ 微信公众号文章 (mp.weixin.qq.com)
  • ✅ 个人博客/技术博客
  • ✅ Medium、Substack
  • ✅ GitHub 文档/README
  • ✅ 知乎文章
  • ✅ 掘金、少数派等技术平台
  • ✅ 任意可访问的网页

功能

  • 🔄 多种抓取方式(Jina Reader → curl → Tavily),自动 fallback
  • 📝 智能生成要点摘要
  • 💾 保存为 Markdown 到 Miaoyan/待学习
  • 📤 回复确认

使用方式

方式 1:直接调用脚本

python3 save_article_to_miaoyan.py "https://example.com/article"

方式 2:通过 OpenClaw 集成

在 OpenClaw 中发送文章链接,自动触发保存流程。

抓取策略

脚本会按以下顺序尝试抓取:

  1. Jina Reader — 最适合博客/技术文章,直接返回 Markdown
  2. curl — 直接 HTTP 请求,适合微信公众号等
  3. Tavily Extract — 备用方案,处理复杂场景

配置

Miaoyan 路径

默认保存路径:

/Users/andy/Library/Mobile Documents/iCloud~com~tw93~miaoyan/Documents/待学习

如需修改,编辑脚本中的 MIAOYAN_DIR 变量。

必需配置

参数说明获取方式
TAVILY_API_KEYTavily API Key(备用抓取)tavily.com 注册获取

配置方式:

export TAVILY_API_KEY="your_api_key"

配置

  1. 检测链接类型 — 识别网站,选择最佳抓取策略
  2. 抓取内容 — 多种方式自动 fallback
  3. 解析 — 提取标题、正文
  4. 摘要 — 智能识别关键句生成摘要
  5. 保存 — 写入 Markdown 文件到 Miaoyan

输出格式

保存的 Markdown 文件包含:

# 文章标题

> 保存时间: YYYY-MM-DD
> 源链接: [原文链接](url)

## 📌 要点

[自动生成的摘要]

---

## 正文

[完整文章内容]

依赖

  • Python 3.7+
  • curl
  • Miaoyan 应用(iCloud 同步)

错误处理

  • 网络超时:20 秒自动放弃
  • 单一方式失败:自动尝试下一种
  • 文件保存失败:自动创建目录

扩展

可修改的部分:

  • MIAOYAN_DIR — 保存路径
  • generate_summary() — 摘要生成算法
  • detect_site_type() — 网站类型检测规则

Comments

Loading comments...