by 安全扫描
OpenClaw
可疑
high confidenceThe skill mostly does what it claims (run tdl and notify via Server 酱) but contains clear inconsistencies and a hard-coded Server 酱 SendKey that causes third-party notification of file metadata — review and fix before installing.
评估建议
This skill's behavior is coherent with its stated purpose (running tdl and notifying via Server 酱), but there are several red flags you should address before installing or using it:
- Hard-coded SendKey: The script contains an embedded Server 酱 SendKey and will send file names, sizes, timestamps and the download directory to sctapi.ftqq.com using that key. If you do not control that SendKey, your download metadata will be sent to someone else. Ask the author to remove the embedded key and accep...详细分析 ▾
⚠ 用途与能力
The skill's stated purpose is to download Telegram content with tdl and notify via Server 酱 — the code implements exactly that. However the registry metadata lists no requirements while SKILL.md metadata declares python 'requests' and a 'tdl' binary; this mismatch suggests the package metadata is incomplete. More importantly, the script embeds a Server 酱 SendKey (sctp6765t...aman) rather than requiring the user to provide credentials, which is not proportionate to a downloader/notify helper and is unexpected for a third‑party integration.
⚠ 指令范围
Runtime instructions and the included script run the tdl binary, list and compare contents of a download directory, build file lists (names, sizes, modified times) and POST that information to the Server 酱 API using the embedded SendKey. Sending file metadata (file names, sizes, timestamps, directory path) to an external endpoint is effectively data exfiltration of metadata — acceptable only if the key belongs to the installer. SKILL.md also references local paths (/root/openclaw/...), but the script does not read those files; this discrepancy reduces clarity about where configuration should live.
✓ 安装机制
No install spec is present (instruction-only plus a single script). That keeps disk writes limited to the included script and the tdl binary invocation; from an installation perspective this is low risk. Nothing is being downloaded/installed from arbitrary URLs by the skill.
⚠ 凭证需求
No required environment variables or primary credential are declared, yet the script hardcodes a Server 酱 SendKey. Best practice would be to require a SENDKEY env var (or other explicit configuration). The skill also assumes a default download directory (/root/tdl_download), which implies root paths and could cause permission/visibility issues. The number and nature of implicit credentials (embedded key) is disproportionate and undocumented in registry metadata.
✓ 持久化与权限
always is false and the skill does not attempt to modify other skills or global agent settings. It will execute autonomously if the agent is allowed to invoke skills (the platform default), which is expected for this kind of helper.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/7
Initial release — Telegram resource downloads with Server酱 WeChat notifications. - Automatically sends WeChat notifications (file names and sizes) upon download completion. - Supports both successful and failed download notifications. - Tracks multiple downloaded files, providing detailed file info and statistics. - Default and customizable download directories. - Simple command-line usage plus OpenClaw integration. - Requires TDL and Server酱 configuration.
● 可疑
安装命令
点击复制官方npx clawhub@latest install tdl-download-notify
镜像加速npx clawhub@latest install tdl-download-notify --registry https://cn.longxiaskill.com