by 安全扫描
OpenClaw
可疑
high confidenceThe skill's README promises automated institutional logins and multi-platform downloads, but the shipped code, dependency metadata, and runtime instructions are inconsistent and ask for credentials in ways that are not implemented — proceed only after clarifying or fixing these gaps and never supply real credentials to it yet.
评估建议
This package is internally inconsistent: the README claims auto-authentication and references modules that are not present, it asks you to set library credentials but the code does not use them, and it mixes Python Playwright instructions with a Node.js runtime executed via subprocess. Do not provide real institutional credentials to this skill. Ask the author (or the registry) for: (1) the missing files (auth.py, doi_extractor.py, config.json), (2) a clear install script that matches the actual...详细分析 ▾
⚠ 用途与能力
The skill claims full automation for institutional authentication, DOI extraction, and platform-specific downloads, but the repository only contains a single download.py that largely prints suggestions and placeholders. SKILL.md also references additional modules (auth.py, doi_extractor.py, references/config.json) that are not present. claw.json lists dependencies for both Python and Playwright, indicating a mix of runtimes; this breadth is disproportionate to the actual implemented functionality.
⚠ 指令范围
SKILL.md instructs installing Python Playwright and running playwright install chromium, and shows environment variables for library credentials (ANNE_LIBRARY_USER/PASS). The actual script does not read those environment variables or implement authentication (it contains comments 'Would need credentials' and 'placeholder'). The code writes a temporary Node.js script and executes it via subprocess, which is not mentioned in SKILL.md. Instructions grant broad discretion (auto-authentication) while the code does not implement it.
⚠ 安装机制
There is no formal install spec in the registry (instruction-only), but SKILL.md recommends pip installing Playwright while claw.json lists dependencies without an install step. The code spawns and runs a Node.js script (requiring node + Node Playwright), but SKILL.md uses Python Playwright instructions—this mismatch between Python and Node runtime/dependency installation is a red flag and could cause users to install the wrong runtime or run code unexpectedly.
⚠ 凭证需求
SKILL.md instructs users to set ANNE_LIBRARY_URL, ANNE_LIBRARY_USER, and ANNE_LIBRARY_PASS, but the skill's manifest declares no required env vars and the shipped code does not consume these variables. Requesting institutional credentials is reasonable for a downloader, but here it's not wired into the code and therefore unjustified; providing credentials to an unclear/partially-implemented skill risks credential exposure.
✓ 持久化与权限
The skill is not forced (always: false) and does not request persistent presence or modify other skills. It is user-invokable and does not declare autonomous always-on privileges, which is appropriate.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/26
Anne's Library Downloader 1.0.0 – Initial release - Automates downloading of books, articles, and DOIs from major academic library platforms. - Supports auto-authentication for institutional access. - Extracts DOIs from URLs and saves metadata with each PDF. - Handles batch downloads from reading lists. - Offers format conversion to PDF, EPUB, and text. - Compatible with platforms including VitalSource, ProQuest, EBSCOhost, JSTOR, PubMed Central, ScienceDirect, Springer Link, and Taylor & Francis Online.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install neckr0ik-anne-library
镜像加速npx clawhub@latest install neckr0ik-anne-library --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制