Young Post Downloader

自动下载 Young Post Club Spark 网站文章并生成 PDF。使用场景：用户要求下载 Today's Read 文章、获取 Young Post 内容、批量抓取教育文章、生成学习材料 PDF、上传飞书云空间。支持：自动解析文章列表、批量下载、HTML 排版、PDF 转换、飞书上传。

This skill appears to do what it says (download Spark articles, make HTML/PDF, upload to Feishu), but a few practical details are missing: 1) Confirm the agent environment provides the web_fetch and feishu_drive_file capabilities (those will handle network requests and Feishu authentication). 2) Ensure google-chrome (headless) is installed on the host — the skill runs 'google-chrome' but the registry didn't list any required binaries. 3) Check where files will be written (WORKSPACE defaults to /home/admin/.openclaw/workspace) and that you’re comfortable with that path and its permissions. 4) Verify Feishu credentials/permissions are available to whatever platform skill performs uploads; the skill itself does not declare or manage OAuth tokens. 5) Respect copyright and rate limits when scraping. If you need higher assurance, ask the author to (a) declare required binaries and credentials in the registry metadata, and (b) replace os.system calls with explicit, audited subprocess calls or platform-provided PDF conversion APIs.

Type: OpenClaw Skill Name: young-post-downloader Version: 1.0.0 The skill bundle implements a workflow for scraping articles and converting them to PDF, but it contains a significant security vulnerability in `scripts/download_articles.py`. The `convert_to_pdf` function uses `os.system` to execute a shell command with f-string interpolation, which is a classic shell injection risk. While the current implementation uses date-based filenames, this pattern is inherently dangerous in an agentic environment. Additionally, the skill requires broad permissions including web fetching, local shell execution, and cloud storage interaction (Feishu/Lark), which could be repurposed for data exfiltration if the agent is compromised via prompt injection.