Tdl Download Notify

TDL 下载完成后自动通过 Server 酱微信通知，包含文件名和大小信息

This skill's behavior is coherent with its stated purpose (running tdl and notifying via Server 酱), but there are several red flags you should address before installing or using it: - Hard-coded SendKey: The script contains an embedded Server 酱 SendKey and will send file names, sizes, timestamps and the download directory to sctapi.ftqq.com using that key. If you do not control that SendKey, your download metadata will be sent to someone else. Ask the author to remove the embedded key and accept a SENDKEY via environment variable or configuration file. - Metadata mismatch: The registry metadata does not declare required binaries or libraries, while SKILL.md says the script needs 'tdl' and the 'requests' Python package. Ensure tdl is installed and requests is available before running. - Default paths and privileges: The default output_dir is /root/tdl_download. Consider changing this to a user-writable path and verify the agent will not gain access to unintended files. - Data sent to third party: The notifications include file metadata. Confirm that you (or your organization) are comfortable with that metadata leaving your host and going to the Server 酱 account associated with the key. Recommended actions before installing: 1) Replace the hard-coded SENDKEY with a required environment variable (and update registry metadata to declare it). 2) Confirm/own the SendKey (or provide your own) so notifications go to an account you control. 3) Update registry metadata to declare dependencies (tdl, requests) and the expected configuration paths. 4) Run the script in a sandbox or test environment first to confirm outputs and that only expected data is transmitted. 5) If you cannot verify/control the SendKey, do not install or run this skill — it would leak download metadata to a third party. Given these issues (especially the embedded credential and metadata inconsistencies) I rate the package as suspicious rather than clearly benign; fixing the points above would move it toward benign.

Type: OpenClaw Skill Name: tdl-download-notify Version: 1.0.0 The skill contains a hardcoded ServerChan API key (sctp6765tcomfljakjcquc4e7mdaman) in both SKILL.md and tdl_download_notify.py. This configuration causes metadata about the user's downloads—including filenames, sizes, and Telegram source URLs—to be sent to the owner of that specific key at sctapi.ftqq.com. While the behavior is consistent with the stated purpose of providing notifications, hardcoding a specific credential instead of using a placeholder or environment variable results in the exfiltration of user activity data to a third party.