Model Pricing Sync

抓取模型厂商与代码工具价格页面，读取 Markdown 后补 JSON 提取文件，并同步到飞书普通电子表格。需要收集模型价格、补全价格 JSON、追踪价格变化或推送 Lark Sheets 时使用。

This skill appears coherent for scraping pricing pages and syncing to Feishu. Before installing: 1) Ensure you install Playwright and run 'playwright install chromium' as the repo suggests (these downloads are large and require network access). 2) Install and configure the Lark/Feishu CLI (npm @larksuiteoapi/cli) and authenticate the account you want the skill to write to—the skill calls lark-cli as a subprocess and will act with that CLI's credentials. 3) Run the skill in a controlled environment (not on a machine with unrelated secrets) because it fetches many public vendor pages and will create/modify spreadsheets in the authenticated Feishu account. 4) Review config/vendors.csv and target CSVs to confirm which vendors/plans will be scraped and tracked. 5) If you plan to allow autonomous agent invocation, be aware the skill can push data to Feishu when invoked; if that is undesired, disable autonomous invocation on the platform. Otherwise there are no clear incoherencies or malicious signs in the provided files.

Type: OpenClaw Skill Name: model-pricing-sync Version: 0.1.1 The skill bundle implements a complex web scraper and data synchronizer for Feishu/Lark Sheets. A significant security vulnerability is present in `scripts/sync_feishu_sheet.py`, which uses `subprocess.run` with `shell=True` on Windows to execute the `lark-cli` tool, creating a risk for shell injection. Additionally, `scripts/collect_pages.py` employs sophisticated scraping techniques, including anti-bot evasion (stealth User-Agents and scripts) and extraction of data from embedded JavaScript, which are high-risk behaviors. While the logic appears aligned with the stated purpose, the combination of broad execution capabilities and the inclusion of speculative/non-existent model versions (e.g., GPT-5.4 and Claude 4.7 in `config/target_api_models.csv`) warrants a suspicious classification.