newspaper-download-skill

报刊 PDF 下载工具。通过 CLI 命令查询已收录的报刊更新、定位指定期次、获取 PDF 下载链接。查询不鉴权，下载需要 Import Token。Newspaper/magazine PDF download tool. Use CLI commands to query collected issues,...

This skill is plausible for getting PDF download links, but exercise caution before installing or using it: 1) The script deliberately bypasses system proxies and disables TLS certificate checks — that can circumvent corporate/network controls and make connections vulnerable to interception. If you run this inside a managed environment, this alone is a strong reason to avoid it. 2) The tool reads an import token from config.json (or IMPORT_TOKEN env) and returns download URLs that include that token — anyone with those URLs can use your token; treat it like a secret. 3) SKILL.md insists you only run the packaged CLI; review the full get_data.py to confirm it never writes files, exfiltrates other secrets, or performs unexpected actions when run without --no-save. 4) Prefer skills with a known source/homepage and audited TLS behavior; if you need this functionality, consider implementing a small trusted client that honors system proxy settings and validates certificates, or run this script in an isolated environment after a careful code review.

Type: OpenClaw Skill Name: newspaper-download-skill Version: 1.0.0 The skill bundle contains a Python script (scripts/get_data.py) that intentionally disables SSL certificate verification (ssl.CERT_NONE) and bypasses system proxies to communicate with pick-read.vip. While these behaviors are documented as workarounds for connectivity issues in AI sandboxes, they constitute a significant security vulnerability by exposing the user's 'import_token' to potential Man-in-the-Middle (MITM) attacks. Per the instructions, this high-risk vulnerability is classified as suspicious rather than malicious as it appears to be a functional choice rather than an intentional exploit.