Netease Music Pusher

自动验证码登录网易云音乐，获取并定时推送个性化每日推荐和公开榜单歌曲信息。

This skill generally does what it says: it uses SMS captcha to log in to music.163.com, fetches daily recommendations and public charts, and saves login cookies so you don't re-login every time. Before installing: 1) Inspect the included scripts yourself (they're in scripts/) to confirm there are no hidden network endpoints or obfuscated code. 2) Note the skill will write cookies to /root/.openclaw/workspace/secrets/netease_cookies.json — treat that as sensitive and ensure only trusted processes can read that directory. 3) The SKILL.md had a base64-block scan hit — check the SKILL.md for any hidden/encoded content. 4) If you want to limit exposure, run the skill in a sandbox or container, or move the cookies path to a location you control, and confirm file permissions. 5) Because the publisher is unknown, prefer manual execution of the login steps and avoid granting broad autonomous privileges until you verify the code. If you want, I can scan the two script files for any network calls or suspicious constructs in more detail.

Type: OpenClaw Skill Name: netease-music-pusher Version: 1.0.0 The skill stores Netease Music session cookies in an unencrypted JSON file (`netease_cookies.json`) within the OpenClaw workspace's `secrets` directory (`/root/.openclaw/workspace/secrets/netease_cookies.json`). While this is intended for legitimate functionality (login persistence for personalized recommendations), storing sensitive session data unencrypted locally is a high-risk behavior. If the OpenClaw environment or filesystem is compromised, these cookies could be stolen, potentially leading to account takeover. There is no evidence of intentional malicious activity like exfiltration or misuse by this skill, but it represents a vulnerability in sensitive data handling.