Meme Collector 热梗收集器

自动搜集最新网络热梗并写入 Dify 知识库。用于定期更新热梗数据库，支持去重。触发词："收集热梗"、"更新热梗"、"热梗入库"、"meme collector"。当用户要求搜集/更新/补充网络热梗到 Dify 知识库时使用此 skill。

This skill appears to do what it says (scrape public pages and write structured entries to a Dify dataset), but the registry metadata doesn't list the Dify credentials it requires — that's a transparency issue. Before installing: (1) verify the skill's source or run it in a sandbox/test agent; (2) only provide a Dify API key with the minimal scope or a throwaway/test dataset ID; (3) consider requiring a manual review step before batch upload to avoid publishing copyrighted or sensitive content; (4) confirm you trust the agent's web_fetch/web_search tools and their network access; (5) if you need stronger assurance, ask the publisher to update the metadata to declare DATASET_ID/API_KEY and to provide a homepage or source provenance.

Type: OpenClaw Skill Name: meme-collector Version: 1.0.0 The skill is classified as suspicious due to two main factors. First, the `scripts/dify_ops.py` script accepts a `--proxy` argument, allowing all Dify API traffic, including the sensitive `API_KEY`, to be routed through an arbitrary, user-specified proxy. This creates a significant risk of credential interception and data exfiltration if a malicious proxy is provided. Second, the `SKILL.md` file directly executes `bash` commands with interpolated variables (`$DATASET_ID`, `$API_KEY`, `$PROXY`). This presents a shell injection vulnerability if the OpenClaw agent does not properly sanitize these inputs before command execution. While the skill's stated purpose is benign, these capabilities introduce high-risk vectors for potential abuse, even without explicit malicious intent within the skill's code itself.