管理追剧清单，自动检查并推送1lou网站的最新剧集更新。

This skill is suspicious rather than clearly malicious. Things to consider before installing or running it: - The documentation and the code disagree in several ways (domain priority, watchlist field name, and whether the skill auto-downloads and adds torrents). That inconsistency could be a sign of sloppy engineering or an incomplete/partially-implemented skill. Don't assume the SKILL.md behavior (automatic torrent downloads, browser automation, checking temp folders, qBittorrent uploads) is implemented just because it's documented. - The code runs shell commands via execSync (curl). This is expected for web-scraping but gives the skill ability to run arbitrary shell commands if the code were changed. Review any user-provided inputs that could be injected into shell commands. In the provided code, the search URL is URL-escaped, which reduces injection risk. - The skill hardcodes a specific user path (/Users/bluepop/...) and LAN addresses (192.168.1.38). If you are not that user or don't want it to access those paths/hosts, do not run it as-is. Prefer configuration options or environment variables rather than hardcoded paths/IPs. - If you want automatic adding of torrents to qBittorrent, insist on a clear, auditable mechanism (qBittorrent Web API with authenticated calls), rather than file-system scraping or opening browser downloads. - Recommendations: (1) Fix the field-name mismatch (search_keyword vs keyword) and make the watchlist path configurable (or relative). (2) Make domain selection and result URLs consistent (use the selected domain when building result links). (3) Remove or explicitly gate instructions that walk arbitrary local temp directories. (4) If automatic downloads are required, implement authenticated API calls to qBittorrent and avoid shelling out to browsers or scanning system temp folders. (5) Run the code in a sandbox and review/modify hardcoded paths/addresses before use. If you don't have the ability to audit or test the code safely, treat this skill as untrusted and avoid installing or running it on your main machine.

Type: OpenClaw Skill Name: 1lou-auto-follow Version: 1.0.0 The skill contains hardcoded absolute file paths for a specific user profile ('/Users/bluepop/'), which is highly irregular and suggests it is either a targeted script or poorly generalized for public use. It utilizes 'execSync' to execute shell commands (curl) with parameters derived from a local JSON file, creating a potential command injection surface despite the use of 'encodeURIComponent'. While the functionality aligns with the stated goal of tracking drama updates on various '1lou' domains (e.g., 1lou.me, 1lou.icu), the environment-specific targeting and risky execution patterns in 'index.js' and 'SKILL.md' make it a security risk.