Автоматический поиск клиентов (родителей) для репетитора по математике в группах ВКонтакте с умной фильтрацией и приоритизацией онлайн-запросов.

Автоматический поиск клиентов (родителей) для репетитора по математике в группах ВКонтакте с умной фильтрацией и приоритизацией онлайн-запросов.

This skill appears to do what it says, but exercise caution before installing: - Source verification: The skill's source/homepage is unknown. Prefer only installing skills from trusted authors or inspect files thoroughly. - Token handling: Do not reuse a high-privilege or personal account token. Create a dedicated VK service token with the minimal required scopes and store it securely (avoid committing it to plain config.json). - Config inconsistencies: The registry metadata omits required credentials while SKILL.md/config.json reference vk_service_token (README calls it access_token). Fix and verify where the token is expected before providing it. - Scraping vs API: SKILL.md allows HTML parsing as fallback. Scraping can violate site terms and may require cookies/extra permissions; prefer using VK API (wall.get) when possible. - Google Sheets mention: If the skill later asks to connect Google Sheets, that will require additional OAuth credentials — be cautious and review any additional prompts. - Scheduling and autonomy: The skill schedules checks every 3 hours and can run autonomously. If you want tighter control, run it manually or require user confirmation before each run. - Test safely: Run the skill in an isolated environment, with a throwaway/limited token and a small set of groups. Monitor network activity, logs, and the CSV output to confirm behavior. If you want, I can: (1) produce a checklist to sanitize the config and secure the token, (2) suggest a minimal VK token scope, or (3) draft a safer config file template that keeps secrets out of checked-in files.

Type: OpenClaw Skill Name: vk-client-search-repetitor Version: 1.0.0 The skill requires and handles a sensitive VK Service Token, performs network requests to VK, and writes collected data (including URLs) to the local file system. While these capabilities are plausibly needed for its stated purpose of finding leads, they represent high-risk operations. The instruction to 'парсинг HTML' (parse HTML) could lead to vulnerabilities depending on the agent's implementation, and saving external URLs to a CSV file (leads_math.csv) could pose risks if not handled securely downstream. No explicit malicious intent, such as data exfiltration to unauthorized endpoints or subversion of the agent via prompt injection, was found in the instructions or configuration.