Skillv1.0.1

ClawScan security

social-media-search · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 15, 2026, 9:25 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: 这个技能的声明目的（在抖音/小红书/B站上执行搜索并返回结果）与它要求的东西一致，没有请求额外凭据或安装任意代码，但注意它会截图/抓取页面内容，可能会捕获已登录用户的私有信息。
Guidance: This skill appears to do what it says: it automates the bundled openclaw browser commands to search Douyin, Xiaohongshu and B站 and return results. Before installing or using it, consider: (1) snapshots may capture private/account-specific content if you are logged in — sign out if you do not want personal data captured; (2) the skill depends on hard-coded element refs (e31, e2) that may break if the sites change, so results can fail silently and require maintenance; (3) ensure you trust the openclaw browser plugin since the skill invokes that plugin to perform navigation and snapshots; (4) no credentials or external endpoints are requested by the skill itself. If these tradeoffs are acceptable, the skill is internally coherent.

Purpose & Capability: okName/description match the runtime instructions: the SKILL.md only automates browser navigation/typing/snapshot to three named Chinese social platforms. No unrelated env vars, binaries, or install steps are requested.
Instruction Scope: noteInstructions stay within the stated purpose (navigate, type into known refs, wait, snapshot). Two points to note: (1) it relies on hard-coded DOM refs (e31, e2) which are fragile and may break if site markup changes; (2) snapshots capture page content and, if the user is logged in, may include private/profile-specific data — the doc suggests checking login state but does not prevent capturing private content.
Install Mechanism: okNo install spec or downloaded code (instruction-only). This is low-risk from an installation/execution perspective because nothing is written to disk by the skill itself.
Credentials: okThe skill requests no environment variables, credentials, or config paths. That is proportional to a browser-automation search skill.
Persistence & Privilege: okalways is false and the skill is user-invocable; it does not request persistent elevated privileges or modify other skills. Autonomous invocation is allowed by default but not unusual here.