quicker-connector

与 Quicker 自动化工具集成，读取、搜索和执行 Quicker 动作列表。支持 CSV 和数据库双数据源，智能匹配用户需求并调用本地 QuickerStarter 执行。

This package appears to be what it claims: a local Quicker integration that reads a CSV/SQLite export and calls QuickerStarter.exe. Before installing: 1) Confirm you run this on Windows with Quicker and QuickerStarter.exe present (or set starter_path to the correct executable). 2) Inspect scripts/quicker_connector.py (and any runner code) to confirm subprocess calls are limited to QuickerStarter.exe and that parameters are validated/sanitized. 3) Install the chardet library if you want robust encoding detection (encoding_detector.py imports chardet but the package metadata does not declare it). 4) Be cautious with auto-execution: set auto_select_threshold high (e.g., 0.8–0.9) if you prefer confirmation before actions run. 5) If you will deploy this in a shared or sensitive environment, restrict who can edit the skill's starter_path/config to avoid pointing the skill at arbitrary executables. If you want, paste the critical parts of scripts/quicker_connector.py here and I can review the exact subprocess/IO behavior line-by-line.

Type: OpenClaw Skill Name: quicker-connector Version: 1.2.0 The skill provides integration with the Quicker automation tool but exhibits several high-risk discrepancies and vulnerabilities. Most notably, scripts/quicker_connector.py contains a QuickerPushRunner class that performs network requests to an external API (push.getquicker.cn), directly contradicting the security claims in SKILL.md and skill.json that state 'no network access.' Furthermore, the execute_action function uses subprocess.Popen with shell=True on Windows, which, combined with the lack of input sanitization for action parameters, creates a significant risk for shell injection (RCE) if the AI agent is manipulated by a user. While these may be unintentional design flaws or undocumented features, the combination of misleading security documentation and critical execution vulnerabilities warrants a suspicious classification.