飞牛论坛签到
v1.0.2飞牛论坛(club.fnnas.com)自动签到。触发场景：(1) 用户要求"飞牛签到"、"飞牛论坛签到"、"fnclub签到"；(2) 设置定时飞牛论坛签到任务；(3) 查询飞牛论坛签到状态。
2· 307·0 当前·0 累计
by 安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (automating sign-in to club.fnnas.com); it requires forum credentials and Baidu OCR keys which are reasonable for its function, but there are a few packaging/metadata and persistence details you should review before installing.
评估建议
This skill appears to do what it says: log into club.fnnas.com, handle captchas via Baidu OCR, and save cookies/tokens for repeated sign-ins. Before installing: (1) confirm the registry metadata vs SKILL.md discrepancy (the skill does require 4 env vars); (2) prefer creating a dedicated/low-privilege forum account (not your primary) because your forum password will be stored/used; (3) if you use 'openclaw config set' the secrets are saved to openclaw.json — verify that file's location and protec...详细分析 ▾
ℹ 用途与能力
The skill's name/description (fnclub sign-in) aligns with the code and instructions, which perform HTTP login and sign-in on club.fnnas.com and use Baidu OCR for captchas. However, the registry metadata shown earlier lists 'Required env vars: none' while SKILL.md and scripts/package.json declare four required environment variables (FNCLUB_USERNAME, FNCLUB_PASSWORD, BAIDU_OCR_API_KEY, BAIDU_OCR_SECRET_KEY). That metadata mismatch is likely a packaging oversight but should be fixed/confirmed.
✓ 指令范围
SKILL.md instructs only to provide forum credentials and Baidu OCR credentials, run npm install in scripts/, and run the Node script or schedule it via OpenClaw cron. The runtime instructions and code operate on the target forum and Baidu OCR service only; they do not request unrelated system files or network endpoints beyond club.fnnas.com and Baidu's OCR API.
ℹ 安装机制
This is instruction + included Node.js script (no platform install spec). The install step is 'cd scripts && npm install' which pulls dependencies from the public npm registry (axios, cheerio, tough-cookie). Those are common libraries and expected for this task, but npm installs execute network downloads and write node_modules to disk — standard but worth noting.
✓ 凭证需求
Required environment variables are exactly the forum username/password and Baidu OCR API key/secret — all justified by the code. These are high-sensitivity secrets (password + API secret). The skill provides an alternative config file path; both methods persist secrets on disk unless you only set them in ephemeral process env. Be aware of where you store them.
ℹ 持久化与权限
The skill does not request elevated platform privileges and 'always' is false. However, it persists session cookies and a cached Baidu access token to disk (scripts/cookies.json, scripts/token_cache.json by default) and SKILL.md suggests storing env vars in openclaw.json via openclaw config commands. That means secrets and session tokens will be stored on disk; check where openclaw.json lives and secure file permissions.
⚠ scripts/fnclub_signer.js:16
Environment variable access combined with network send.
⚠ scripts/fnclub_signer.js:21
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/10
- Updated environment variable setup command for ClawHub for improved clarity and security. - Added a dedicated "安装" (installation) section with npm install instructions for script dependencies. - Listed required Node.js dependencies (`axios`, `cheerio`, `tough-cookie`) explicitly. - Clarified and updated file descriptions and usage instructions, including notes on automatic cache generation. - Minor formatting improvements and guidance for both environment variable and config file setups.
● 无害
安装命令 点击复制
官方npx clawhub@latest install fnclub-signer
镜像加速npx clawhub@latest install fnclub-signer --registry https://cn.clawhub-mirror.com
技能文档
自动完成飞牛私有云论坛(club.fnnas.com)每日签到，获取飞牛币奖励。
凭证要求
本技能需要以下环境变量才能正常运行：
| 变量名 | 说明 | 是否必需 | 敏感性 |
|---|---|---|---|
FNCLUB_USERNAME | club.fnnas.com 登录用户名 | ✅ 是 | 🔴 高 |
FNCLUB_PASSWORD | club.fnnas.com 登录密码 | ✅ 是 | 🔴 高 |
BAIDU_OCR_API_KEY | 百度 OCR API 访问密钥 | ✅ 是 | 🟡 中 |
BAIDU_OCR_SECRET_KEY | 百度 OCR API 密钥 | ✅ 是 | 🟡 中 |
可选环境变量
| 变量名 | 说明 | 默认值 |
|---|---|---|
FNCLUB_CONFIG | 配置文件路径 | scripts/config.json |
FNCLUB_DATA_DIR | 数据目录（Cookie/Token缓存） | scripts/ |
方式一：ClawHub 环境变量（推荐）
注意：这样添加环境变量会保存在 openclaw.json 中，不会暴露在系统环境变量中。
openclaw config set env.vars.FNCLUB_USERNAME "你的用户名"
openclaw config set env.vars.FNCLUB_PASSWORD "你的密码"
openclaw config set env.vars.BAIDU_OCR_API_KEY "你的百度OCR API Key"
openclaw config set env.vars.BAIDU_OCR_SECRET_KEY "你的百度OCR Secret Key"
方式二：配置文件
在 scripts/config.json 中配置：
{
"username": "你的用户名",
"password": "你的密码",
"baidu_ocr_api_key": "百度OCR API Key",
"baidu_ocr_secret_key": "百度OCR Secret Key"
}
获取百度OCR API
- 访问 百度AI开放平台
- 创建应用，选择"文字识别"服务
- 获取 API Key 和 Secret Key
安装
安装 Node.js 依赖
cd scripts
npm install
这将安装以下依赖：
axios- HTTP 请求库cheerio- HTML 解析库tough-cookie- Cookie 管理库
使用
手动签到
node scripts/fnclub_signer.js
定时签到
使用 OpenClaw cron 设置每日自动签到：
openclaw cron add \
--name "fnclub-signer" \
--every "1d" \
--session main \
--system-event "fnclub-sign" \
--description "飞牛论坛每日签到" \
--tz "Asia/Shanghai"
文件说明
scripts/fnclub_signer.js- 主签到脚本 (Node.js) ✅ 推荐scripts/config.json.example- 配置文件模板scripts/config.json- 配置文件（需手动创建，通过命令的形式设置变量不需要创建）scripts/cookies.json- Cookie缓存（首次登录后自动生成）scripts/token_cache.json- 百度OCR Token缓存（首次需要验证码时自动生成）scripts/node_modules/- Node.js 依赖
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制