by 安全扫描
OpenClaw
安全
medium confidence该技能的代码和指令与其声明的目的一致（捕获 Grok 会话响应并转换为 Obsidian Markdown），但在浏览器控制台运行第三方 JS 和存储捕获数据在 localStorage 中存在隐私/操作风险，使用前应了解。
评估建议
["该技能逻辑一致：捕获脚本仅拦截特定的 Grok API 响应，Python 转换器将 JSON 格式化为 Markdown。但运行第三方 JavaScript 前须谨慎：该 JS 具有页面的 JavaScript 权限，可读取 DOM 状态、页面数据和 localStorage。","使用前检查：","- 自行或让信任的人审查完整的 `export_grok_items_capture.js` 内容，确保脚本最后部分仅触发本地下载（Blob），而非向远程端点 POST。","- Prefer 在专用浏览器配置文件或临时会话中运行捕获，仅包含要导出的账户，限制其他 cookie/存储/凭据的暴露。","- 注意捕获 JSON 包含会话内容，可能包括 'thinking_trace'（模型推理）。默认情况下，除非明确需要内部追踪，否则使用转换器时不包含推理（--include-reasoning）。","- 运行完成后，检查并删除 localStorage 检查点键（CHECKPOINT_KEY），如果不希望捕获在您的配置文件中保留；README 表示脚本在成功时清除它，但请手动验证。...详细分析 ▾
✓ 用途与能力
The name/description match the included assets: a browser DevTools capture script that intercepts GrokConversationItemsByRestId responses and a Python converter that turns the captured JSON into Obsidian-ready Markdown. No unrelated binaries, env vars, or services are requested.
ℹ 指令范围
SKILL.md tells the agent/user to paste and run the provided export_grok_items_capture.js in the DevTools console while logged in and then run the local Python script. The browser script intercepts fetch/XHR for a specific GraphQL response type, navigates the SPA (history.pushState / clicking), stores checkpoints in localStorage, and downloads a JSON capture. All of these actions are consistent with the stated capture purpose. Caveat: running arbitrary third-party JS in your console grants that code access to whatever the page's JavaScript environment exposes (DOM, localStorage, in-page JavaScript objects and responses). The script also persists captured checkpoints in localStorage, which may retain sensitive content until cleared.
✓ 安装机制
No install steps or external downloads are declared; this is an instruction-only skill with two included scripts. That minimizes installer risk. Files are run by the user (paste into console / run Python locally).
✓ 凭证需求
The skill requests no environment variables or credentials. It does require you be logged into X in the browser to capture responses — which is appropriate for capturing your Grok chats. The script does not declare or require unrelated secrets. Note that the captured JSON will contain the conversation content (including optional thinking_trace blocks) and should be protected accordingly.
ℹ 持久化与权限
The script writes checkpoints into browser localStorage under a clearly named key (CHECKPOINT_KEY) and is designed to clear them on successful completion. It does not request always:true or system-wide privileges. Still, localStorage persistence means captured content may remain in your browser profile until explicitly cleared; use a disposable profile or clear the checkpoint key after use if desired.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/2/27
初始发布：网络捕获 + Markdown 转换 + 恢复/检查点 + 速率限制处理
● 无害
安装命令 点击复制
官方npx clawhub@latest install x-grok-to-obsidian
镜像加速npx clawhub@latest install x-grok-to-obsidian --registry https://cn.clawhub-mirror.com
技能文档
功能描述
通过浏览器网络捕获从 X (x.com) 导出 Grok 会话，并将其转换为 Obsidian 可读的 Markdown 文件。用于备份 Grok 会话。使用指南
- 浏览器控制台运行捕获脚本
- 转换为 Obsidian Markdown
注意事项
- 隐私风险：脚本运行在浏览器中，访问您的会话数据。
- 操作风险：确保脚本仅用于本地下载，不向远程端点发送数据。
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制