搜索并播放电影，支持按类型/年份/评分筛选，中英文输入，生成 iframe 播放页面

搜索并播放电影。功能包括：(1) 按类型、年份、评分筛选电影；(2) 支持中英文输入；(3) 展示电影海报、评分、剧情简介；(4) 生成可点击的 iframe 播放页面，直接在线观看。触发场景包括：搜索电影、想看电影、找最新电影、按类型/年份/评分筛选电影。

This skill will search for movie metadata and produce an HTML page that embeds third‑party streaming URLs. Before installing: - Be aware the SKILL.md says to use the TMDB API but the skill declares no TMDB API key or environment variable — if the skill attempts to call TMDB you may need to supply an API key or it will scrape pages instead. - The play sources listed (2embed, vidcloud, soap2day, etc.) are third‑party embed sites that are frequently untrusted or host infringing content; embedding their URLs directly can expose you to malware, tracking, or legal/terms risks. - The generator script simply injects provided URLs into iframe src without validating or sanitizing them; a malicious or compromised source could serve harmful content when the page is opened. Recommendations: - If you install, inspect and run the skill in a sandboxed environment first; review any network activity and the exact sites it searches/uses. - Consider blocking unknown streaming hosts at the network level or restricting the skill to only use trusted sources (and require an explicit TMDB API key instead of scraping). - If you need metadata from TMDB, prefer configuring a TMDB API key and update the skill to declare that requirement explicitly. What would change the assessment: explicit declaration of required TMDB credentials and a documented whitelist/validation step for streaming sources would reduce the concerns and could move this toward benign.

Type: OpenClaw Skill Name: movie-finder Version: 1.0.1 The movie-finder skill is classified as suspicious because the `scripts/generate_movie_page.py` script lacks input sanitization, using direct string interpolation to generate HTML which creates a Cross-Site Scripting (XSS) vulnerability if the agent retrieves malicious metadata. Additionally, `SKILL.md` explicitly instructs the agent to source content from high-risk pirate streaming domains (e.g., `2embed.ru`, `vidcloud.co`, `vidsrc.me`) that are frequently associated with malvertising and untrusted third-party content. While the skill's behavior aligns with its stated purpose, these implementation flaws and the reliance on risky external sources pose a security threat to the user.