📦 Restaurant Recommendation Cross-Validation — 餐厅推荐交叉验证
v1.0.0将小红书与大众点评的餐厅推荐交叉比对，自动抓取评分、评论量并分析一致性，为指定城市/区域输出带置信度的可信推荐。
2· 1.1k·2 当前·3 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
medium confidenceThe skill largely does what it says (scrapes Dianping and Xiaohongshu and cross-checks results) but includes persistent session handling, scraping instructions that violate platform TOS, and an easy path to accidentally store/publish authentication cookies or proxy credentials — these mismatch the minimal safety assumptions a user might have.
评估建议
What to consider before installing or running this skill:
- Legal/ToS: Both Dianping and Xiaohongshu explicitly prohibit scraping in their docs; using the 'real' scraping mode may violate platform terms and local law — only use for personal research and accept the legal risk.
- Session cookies: The skill saves browser sessions/cookies locally (sessions/ and session_state.json). Do NOT run setup.sh or login on shared/cloud machines. Before publishing or sharing the repo, ensure sessions/ and any...详细分析 ▾
✓ 用途与能力
The code and documentation match the stated purpose: fetching data from Dianping and Xiaohongshu, fuzzy-matching restaurants, and computing consistency/recommendation scores. Libraries (requests, bs4, thefuzz, Playwright) and matching/sentiment logic are appropriate to that goal.
⚠ 指令范围
SKILL.md and IMPLEMENTATION.md explicitly instruct the agent to perform web scraping, use persistent authenticated browser sessions, rotate proxies, and store cookies/sessions locally. This goes beyond a simple read-only lookup: it instructs actions that can log in as a user (cookies), maintain persistent authenticated sessions, and mimic human browsing (Playwright). Those instructions also push the operator toward anti-scraping workarounds (residential proxies, user-agent rotation), which raises legal/compliance and operational risk.
ℹ 安装机制
No formal registry install spec in the skill meta, but repository includes setup.sh that installs Python deps and downloads Playwright browsers. Installing Playwright and pip packages is standard for such tooling, but setup.sh should be reviewed before running. There are no obscure external download URLs in the provided files, but Playwright will download browser binaries from upstream.
⚠ 凭证需求
The skill declares no required env vars, but it persistently stores authenticated sessions (cookies/localStorage) under a sessions/ directory and expects proxies (proxy_list) to be configured. That is proportional to scraping functionality, but it creates a risk: sensitive session cookies or proxy credentials may be stored in plain files (scripts/config.py or sessions/) and could be accidentally committed/published. The skill's docs even guide publishing; there are no explicit safeguards (e.g., .gitignore) shown to prevent leaking session data or credentials.
⚠ 持久化与权限
The skill includes a session manager that persists login state and claims to auto-login and maintain sessions for 1–2 weeks. While always:false, the agent can be invoked autonomously; combined with persistent authenticated sessions, this means the skill can make authenticated requests on behalf of the user without re-authentication. This increases the blast radius if credentials or sessions are leaked or if the skill is misused.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/9
Initial release Features: - Cross-platform validation (Dianping + Xiaohongshu) - Location-based search by city/district - Cuisine type filtering - Consistency analysis between platforms - Recommendation scoring (0-10) - Server-friendly command-line tool - Full documentation (Chinese + English)
● 可疑
安装命令
点击复制官方npx clawhub@latest install restaurant-crosscheck
镜像加速npx clawhub@latest install restaurant-crosscheck --registry https://cn.longxiaskill.com