知识星球帖子抓取助手

知识星球帖子抓取助手 — 自动抓取指定星球的最新帖子，支持全部/仅精华两种筛选模式，支持通过帖子链接或 ID 获取单条帖子详情，支持多星球配置。本 Skill 应在用户需要查看、汇总或检索知识星球内容时使用。

What to consider before installing: - Credential handling: The script expects ZSXQ_TOKEN but also contains a DEFAULT_TOKEN and will read/write a local token.json. If you do not set ZSXQ_TOKEN, the skill may use the embedded default (an account you don't control). Always set ZSXQ_TOKEN in your environment to your own token rather than relying on any default. - Local persistence: The skill will create/overwrite {skill_dir}/token.json. If you provide a token and do not want it stored on disk, inspect and remove or restrict token.json (set permissions to 600) or modify the code to disable saving. - Documentation mismatch: The registry metadata says no required env vars but SKILL.md declares primaryEnv: ZSXQ_TOKEN. Treat ZSXQ_TOKEN as required; the registry metadata appears out-of-date or incorrect. - Code review: If you are not comfortable with defaults that enable network access without your explicit token, open fetch_topics.js and either remove the DEFAULT_TOKEN and saveToken logic or ensure it only uses env var. Also check where saveToken is invoked to confirm it won't overwrite your token unexpectedly. - Network scope: The script only talks to https://api.zsxq.com (per code and API reference). That is consistent with its purpose; there are no other remote hosts or obfuscated endpoints in the files provided. If you decide to install: set ZSXQ_TOKEN explicitly, inspect and (if desired) delete token.json after use, and verify token.json permissions. If you need higher assurance, consider removing the DEFAULT_TOKEN constant before running.

Type: OpenClaw Skill Name: zsxq-fetch Version: 1.0.0 The skill bundle is a functional tool designed to fetch posts and group information from the Knowledge Planet (ZSXQ) platform via its official API (api.zsxq.com). The code in fetch_topics.js uses standard Node.js HTTPS modules, implements proper rate limiting with exponential backoff, and handles authentication via a user-provided token. While it contains a hardcoded default token and logic to persist tokens locally in token.json, there is no evidence of data exfiltration to unauthorized domains, malicious command execution, or harmful prompt injection instructions.