📦 Website Pickpocket — 网站克隆
v0.1.0一键克隆任意网站：静态/动态页面抓取、资源下载，并输出原生HTML/React/Vue/Angular多框架代码，方便离线浏览、备份迁移或快速二次开发。
0· 301·0 当前·0 累计
by @zhenyangze下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This SKILL.md describes a powerful website-cloning tool but is only documentation — it provides no code, binaries, or trusted homepage. Before installing or running anything based on it: (1) verify the upstream project and install from an official release (the skill provides no install/source); (2) do not paste real session cookies, passwords, or secrets into configs unless you fully trust the code and install environment; (3) be aware of legal and terms-of-service issues when cloning sites and ...详细分析 ▾
ℹ 用途与能力
The SKILL.md consistently describes a website-cloning tool (static/dynamic scraping, framework outputs). However, the documented capabilities depend on significant third-party components (Playwright, Cheerio, Sharp, etc.) and browser binaries; the skill does not declare required binaries, environment variables, or provide an install mechanism. That omission is common for instruction-only skills but is a material mismatch between capability and what's provided.
ℹ 指令范围
Instructions are concrete (CLI flags, config file schema, workflow) and stay within the stated purpose. They do reference handling login/session data (cookies, localStorage), custom wait selectors, proxies, and user-agent spoofing — all expected for a scraper but also capable of accessing or transmitting sensitive session information if users supply it. The SKILL.md does not instruct the agent to access arbitrary system files or hidden credentials, but it does rely on user-provided session data.
⚠ 安装机制
No install spec is provided (instruction-only). Given the listed tech stack (Playwright requires browser installs; Sharp may need native libs), running the described tool would require installing multiple packages and browser binaries. The absence of guidance or a trustworthy upstream source/homepage increases risk: the agent/user might be asked to run or fetch unknown binaries to realize functionality.
ℹ 凭证需求
The skill requests no environment variables or credentials in metadata, which is proportional. However, the runtime docs encourage supplying session cookies/localStorage values in config. Those are sensitive and should only be supplied deliberately; the skill does not explain secure handling or storage of those values.
✓ 持久化与权限
The skill is not forced-always and does not request persistent privileges. It is user-invocable and can be invoked autonomously by the agent (default behavior), but there is no additional persistent system presence requested.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/12
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install website-pickpocket-skill
镜像加速npx clawhub@latest install website-pickpocket-skill --registry https://cn.longxiaskill.com镜像同步中