微博热搜采集 | Weibo Hot Search

微博多频道热搜数据采集与可视化 | Weibo Multi-Channel Hot Search Data Collection & Visualization 支持热搜总榜、社会榜、文娱榜、生活榜同时抓取 | Supports hot search, social, entertainment, life ch...

This package mostly does what it claims (collect Weibo hot-search items, save to a SQLite DB, and create an HTML report), but there are notable concerns you should address before running it: - The scripts rely on an external CLI 'openclaw browser' to open pages and capture snapshots, but SKILL.md and the manifest do not declare this dependency. Ensure you have 'openclaw' installed from a trusted source before using the scripts. - The fetcher uses subprocess.run with shell=True to execute commands like: openclaw browser open --profile openclaw '{url}'. Those commands include URLs and other strings derived from parsed page snapshots. If an attacker can influence snapshot output (or if a malformed URL contains shell metacharacters), this can lead to command injection. Consider running the tool only in an isolated environment (VM/container) and inspect/clean inputs first. - If you plan to use this skill: (1) Review and/or modify fetch-hot-search.py and fetch-topic-content to avoid shell=True and to pass command arguments as lists to subprocess.run; (2) sanitize or validate any URL or title data before embedding into shell commands; (3) explicitly document and verify the 'openclaw' dependency in SKILL.md; (4) run initial tests with a non-privileged user and in a sandbox; (5) consider adding explicit warnings in SKILL.md about the browser dependency and security considerations. If you want higher assurance, ask the author to declare the 'openclaw' dependency and to replace shell invocations with safe APIs or subprocess argument lists and to add input sanitization. Without those changes, treat the skill as potentially risky on sensitive hosts.

Type: OpenClaw Skill Name: weibo-trending Version: 1.0.0 The skill bundle provides legitimate functionality for scraping and visualizing Weibo hot search data, but it contains critical security vulnerabilities. Specifically, 'scripts/fetch-hot-search.py' uses 'subprocess.run' with 'shell=True' to process URLs parsed directly from external web content, which creates a significant shell injection risk. Additionally, 'scripts/query.py' uses string formatting to construct SQL queries, introducing a potential SQL injection vector. While these appear to be unintentional coding flaws rather than intentional malice, they constitute high-risk behaviors that could be exploited by malicious content on the scraped pages.