Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Daily Antifraud Report
v1.0.0每天早上生成反诈简报：查询中国国内银行以及支付机构等反欺诈新闻，需要详细的反诈信息。 Use when: 用户说"生成今日反诈简报"，或 cron 在早上 8 点触发。 NOT FOR: 国外银行或金融机构的新闻。
⭐ 0· 118·0 current·0 all-time
by@wdl2005
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md says gather detailed items from sources including 中国新闻网, 人民银行网站, 百度, 知乎, 以及微信公众号 and then push the report to 飞书. The only shipped code is a simple Baidu HTML-scraping script (scripts/search_cn.sh). There is no code or declared env vars to read WeChat public account content or to authenticate/post to Feishu, so required capabilities for the stated workflow are missing.
Instruction Scope
Instructions ask the agent to collect detailed case-level data (times, modus operandi, bank names, amounts) and to push results to Feishu. The SKILL.md grants broad discretion about sources (including 微信公众号) but provides no safe, authenticated mechanisms. The included script only performs an unauthenticated Baidu search and then extracts links/titles; it does not implement the richer data collection or the Feishu push described.
Install Mechanism
No install spec — instruction-only with a small helper script. This is low-risk from an install perspective. Minor portability note: the script uses grep -oP (Perl regex) which is not available in all environments and may fail on some systems.
Credentials
SKILL.md references pushing to Feishu and reading WeChat public accounts, which normally require tokens or API credentials, yet requires.env and primary credential fields are empty. The absence of declared env vars for Feishu/WeChat is an incoherence: either the skill expects credentials to be provided ad-hoc (risk of ad hoc secret entry) or the integration is missing.
Persistence & Privilege
always is false and there are no install scripts or config writes. Autonomous invocation is allowed (platform default) but there is no requested persistent privilege. No evidence the skill modifies other skills or system settings.
What to consider before installing
This skill's goal (daily Chinese anti-fraud brief) is reasonable, but there are important gaps and ambiguities: it mentions scraping WeChat public accounts and pushing reports to Feishu but supplies only a simple Baidu-scraping shell script and declares no credentials. Before installing, ask the publisher to: (1) explain how Feishu posting will be authenticated and add explicit env var names (e.g., FEISHU_TOKEN) if needed; (2) clarify how 微信公众号 content will be accessed (API vs scraping) and provide code or required credentials; (3) add robust scraping/parsing (and rate-limiting and robots.txt/legal checks) rather than brittle HTML greps; (4) fix portability issues (grep -P dependency) or implement a more portable parser. Do not provide production credentials or secrets until integrations and required env vars are explicit and reviewed. If you plan to run it, test in an isolated environment and monitor outbound network activity.Like a lobster shell, security has layers — review code before you run it.
latestvk97cd8bnvgb9ppjk23k4k9g5h9837xe6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.