Content Catcher

虾抓抓(xia-zhua-zhua) v4.0 - 超强内容抓取技能 支持：Markdown/PDF/多模态提取/结构化抽取/翻译/视频下载 触发词：抓取网页、网页转Markdown、内容抓取、虾抓抓、视频下载

This package bundles a capable scraper/downloader and also browser-extension code that can modify request headers, read page DOM, and write files on your machine. It has several inconsistencies: SKILL.md mentions dependencies (Playwright, yt-dlp, weasyprint) but the registry lists none; instructions reference files/scripts and paths that don't line up with the manifest; extension code expects Chrome extension permissions (declarativeNetRequest, downloads, runtime) but there's no install guide or permission disclosure. Before installing or running: 1) Don't run scripts as your primary account — use an isolated VM or container. 2) Inspect any places that set remote URLs or mitm endpoints (e.g., streamSaver/ffmpeg endpoints) to ensure they point to trusted services. 3) If you plan to use the extension pieces, review and audit required browser permissions and the extension manifest (not included) — granting declarativeNetRequest and downloads allows header/cookie injection and arbitrary file downloads. 4) Verify missing files and paths referenced in SKILL.md (e.g., content-watcher.js) and ensure you have trustworthy provenance (homepage/author). 5) If you lack the ability to audit, avoid installing or run only in a sandboxed environment. Additional information that would raise confidence: a clear install script, an extension manifest showing requested permissions, a homepage/repo with commits, and explicit justification for header-modification behavior.

Type: OpenClaw Skill Name: xia-zhua-zhua Version: 4.0.1 The bundle is a comprehensive web scraping and video downloading tool that includes a ported version of the 'Cat Catch' browser extension core. It contains high-risk capabilities, such as the 'send2local' function in 'cat-catch-core/function.js', which allows sending data to arbitrary URLs, and the use of 'execSync' to run Python scripts from Node.js. Furthermore, 'video_catcher_pro.py' contains hardcoded Windows file paths (e.g., 'C:\Users\26240\workspace\video-downloads') from the developer's environment, indicating a lack of sanitization. While these features support the stated functionality, the combination of broad network access, shell execution, and hardcoded environment leaks warrants a suspicious classification.