Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Mirror Website
v1.0.0镜像网站到本地的完整工作流。当用户说镜像网站、下载网站、抓取网站、本地化网站，或者提供一个网址和保存路径时，必须使用此 skill。输入格式为：镜像网站 www.example.com 保存地址 /a/b/c。自动处理代理、递归下载、文件名清理等全流程。即使用户只是提到想把某个网站保存到本地、离线浏览、克隆站点，...
⭐ 0· 69·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md actions (curl/wget/creating scripts, cleaning filenames, starting a local HTTP server) are coherent with a website-mirroring purpose. However the skill does not declare required system binaries that it clearly relies on (wget, curl, grep, sed, find, mv/rename, bash, python or similar for preview), which is an omission and reduces transparency.
Instruction Scope
Instructions tell the agent to create and execute shell scripts in arbitrary user-specified directories, scan and rewrite downloaded HTML/CSS/JS, and forcibly ignore robots.txt and SSL certificate validation. While these are related to mirroring, they broaden the agent's actions (writing/executing files, changing network behavior) and include steps (robots=off, --no-check-certificate) that are ethically and security-sensitive.
Install Mechanism
This is instruction-only with no install spec or external downloads, which reduces supply-chain risk. There is nothing being fetched or installed by the skill itself.
Credentials
The skill declares no environment variables or credentials, yet the runtime instructions set http(s)_proxy and rely on local proxy 127.0.0.1:7890 if available. It also implicitly requires many CLI tools that are not listed. The discrepancy between declared requirements (none) and actual required system tools/environment is a proportionality and transparency problem.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is user-invocable only. It will write files to user-specified locations, which is expected for this functionality but is not the same as requesting persistent elevated platform privileges.
What to consider before installing
This skill appears to do what it says (mirror websites) but exercise caution before installing or running it:
- Verify the agent environment has the required CLI tools (wget, curl, grep, sed, find, mv/rename, bash, and a Python or other static web server for preview). The SKILL.md relies on these but the skill metadata does not declare them.
- The skill explicitly disables robots.txt and skips SSL certificate checks (--no-check-certificate, -e robots=off). That can be legally or ethically problematic and may expose you to unsafe content; only proceed if you understand and accept the implications for the target site.
- The instructions create and execute shell scripts in the chosen save path. Review any generated scripts (fetch-query-assets.sh, fix-filenames.sh, etc.) before executing to ensure they do only what you expect and are not pointed at sensitive system paths.
- The skill may set http(s)_proxy to a local proxy at 127.0.0.1:7890 if direct access fails. Ensure you trust any local proxy and understand that traffic may be routed through it.
- Avoid saving mirrors to sensitive directories (e.g., system paths, home root) and prefer running in a disposable or restricted environment. Consider running the workflow in a sandbox or VM if you are unsure.
If you want to proceed, ask the skill to report the exact commands and to show the full contents of any scripts it will write before it executes them; do not allow blind execution of created files.Like a lobster shell, security has layers — review code before you run it.
latestvk970saa6vw7mftnmaced0p60kd838b52
License
MIT-0
Free to use, modify, and redistribute. No attribution required.