Brand Monitor - 品牌舆情监控
Analysis
The skill has a coherent brand-monitoring purpose, but its safety text misstates the third-party data flow by saying it does not send data outside Feishu while the included crawler uses SerpAPI.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
✅ 不依赖第三方搜索 API（无需 Brave/Perplexity API Key） ... ✅ 不发送数据到第三方服务器（除了配置的飞书 Webhook）
This safety claim says data is not sent to third parties except Feishu, but the included crawler uses SerpAPI (`crawler/search_crawler_serpapi.py` shows `self.base_url = "https://serpapi.com/search"`) and the docs require `SERPAPI_KEY`. Users could be misled about where search terms and monitoring queries go.
cd ~/.openclaw/workspace/skills/brand-monitor/crawler
python search_crawler_serpapi.py "{{brand_name}}" "{{platforms_list}}" 20 {{monitor_hours}}The agent is instructed to use shell execution to run the local crawler with configured brand/platform parameters. This is central to the skill’s purpose, but it is still command execution.
requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0
The Python dependencies use minimum-version ranges rather than exact pins, and install.sh installs them from the package index. This is common and purpose-aligned, but dependency versions can drift over time.
# 每天早上 9 点执行品牌监控 0 9 * * * cd ~/.openclaw && openclaw agent --message "执行品牌监控" >> /var/log/brand-monitor.log 2>&1
The documentation shows how to schedule recurring agent execution. This is user-directed and fits a monitoring tool, but it creates ongoing background activity.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
if [ -z "$SERPAPI_KEY" ]; then ... else
echo "✓ SERPAPI_KEY 已设置"
echo " Key: ${SERPAPI_KEY:0:10}..."The installer checks for a SerpAPI credential and prints the first characters of it. The credential use is expected for SerpAPI, but it is under-declared in registry metadata and should not be exposed in shared logs.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
使用 `memory` 工具保存监控数据 ... "top_mentions": [
{前5条提及的完整数据}
],The skill saves monitoring summaries and top mention details into persistent memory so later trend analysis can read them. This supports the stated trend-analysis feature, but retained public/web data may be reused in later tasks.