Xiaoqian

自动登录江苏海事局综合平台查询指定日期范围内的全局会议信息并导出包含时间、地点和参会人员的结构化数据。

This skill mostly does what it says (automates login and scraping of the Jiangsu MSA portal), but exercise caution before installing: 1) The SKILL.md and code include plaintext default credentials — do NOT use these defaults; treat them as potential leaked/stale credentials and rotate any affected account. 2) The code expects MSA_USERNAME/MSA_PASSWORD but the skill metadata does not declare required env vars — if you install, set those env vars yourself rather than relying on defaults. 3) The script downloads ChromeDriver at runtime and attempts to hide automation (navigator.webdriver override), which increases network and detection-evasion behavior; run it in a controlled sandbox or VM and review network activity. 4) Verify the skill's provenance (who published it) before giving it access to credentials or your network. If you cannot confirm origin or do not want the script to handle credentials, do not install/run it; alternatively, extract and review the script first, remove hard-coded defaults, and supply credentials via secure environment variables or a secrets manager.

Type: OpenClaw Skill Name: xiaoqian Version: 1.0.3 The skill bundle contains hardcoded plaintext credentials (username: 'lp@njmsa', password: '@lp280033') for the Jiangsu Maritime Safety Administration portal within both SKILL.md and query_meetings.py. While the script appears to perform its stated function of automating meeting data collection via Selenium, the exposure of static credentials and the lack of input sanitization for date fields represent significant security vulnerabilities. There is no clear evidence of intentional data exfiltration to external attacker-controlled domains, but the inclusion of credentials for a specific government portal is highly irregular.