专业解析番茄小说IP内容，提取世界观、人物设定、核心冲突及爽点，完成内容合规初检，助力AI剧本改编。

This skill is mostly coherent but has two practical concerns: (1) it will transmit the entire novel text you provide to whatever API endpoint (API_BASE) you configure — only use a trusted LLM provider or avoid sending copyrighted/sensitive text; (2) the 'compliance_check' promised by the description is a no-op in the code (always returns is_safe:true), so do not rely on it for real content-safety screening. Additional small issues: manifest version differs from registry version (cosmetic) and the code lacks error handling when parsing model output. If you plan to install, verify the API_BASE you set, consider adding a real compliance step or local screening before sending text, and test with non-sensitive inputs first.

Type: OpenClaw Skill Name: 01-tomato-ip-parse Version: 1.0.5 The skill is designed to parse novel content using an LLM, but it is classified as suspicious due to a prompt injection vulnerability in `skill.js`, where `novel_title` and `novel_text` are directly embedded into the prompt template without sanitization. Additionally, while `SKILL.md` claims to perform a 'content compliance check,' the implementation in `skill.js` is a placeholder that hardcodes a successful result. The skill relies on user-provided environment variables (`API_KEY`, `API_BASE`) to function, and while no intentional data exfiltration was detected, the lack of input handling poses a risk if processing untrusted novel text.