数字宠物 - 一个可爱的 3D 拉布布（Labubu）数字宠物，支持互动喂食、玩耍、抚摸。用于：(1) 桌面宠物陪伴，(2) 3D 互动展示，(3) 宠物养成游戏。

This package appears to be a local desktop/browser 3D pet and is internally consistent with that purpose. Before running: (1) note the Python desktop app requires PyQt5 and PyQtWebEngine (pip install PyQt5 PyQtWebEngine) and will create an always-on-top, frameless window that follows the mouse — consider running it in a VM or disposable environment if you are cautious; (2) the front-end loads Three.js from a CDN so Internet access is needed for the demo; (3) I observed likely bugs where scripts (serve.py and desktop_pet.py) construct paths using the scripts/ directory rather than the repository root — you may need to run from a particular working directory or move files for the server/desktop app to find pet_widget.html/index.html; (4) desktop_pet exposes a WebChannel bridge (pybridge) so JavaScript can call limited Python methods (moveToMouse/log); currently these methods are simple and intended for UI control, but if you modify the files be careful not to expose sensitive APIs to web content; (5) there are no requested credentials or obvious exfiltration endpoints in the provided files. If you want higher assurance, run the app in a sandbox, inspect pet_widget.html/index.html for any remote URLs beyond the three.js CDN, and fix the path assumptions in the scripts so the server serves the intended HTML assets.

Type: OpenClaw Skill Name: digital-pet Version: 1.0.0 The skill bundle is classified as suspicious due to the `scripts/desktop_pet.py` component. This Python script uses `PyQt5` and `QWebEngineView` to create a desktop pet, exposing a `PetBridge` object to JavaScript via `QWebChannel`. The `PetBridge` includes a `moveToMouse(x, y)` method, allowing JavaScript to directly control the desktop window's position. While the provided `pet_widget.html` does not actively utilize this method for its primary movement logic (which is handled by Python's `updatePosition` based on `QCursor.pos()`), exposing direct window manipulation to a webview creates a potential vulnerability. If the `pet_widget.html` were compromised (e.g., via XSS or by loading untrusted remote content), an attacker could potentially move the application window arbitrarily on the user's screen, including off-screen to hide it, or to cover other UI elements. This is a risky capability without clear malicious intent, aligning with the 'suspicious' classification.