v2ex-monitor

监控指定 V2EX 节点的新帖与提醒，生成 Markdown 汇总报告，支持 MCP 查询和定时拉取数据。

This skill appears to implement exactly what it claims (monitor V2EX nodes, fetch notifications, generate Markdown reports, and expose MCP tools) and it only needs a V2EX API key stored in a local config file. However, before installing or running it: 1) Review and fix the code that disables TLS verification (search for ssl.CERT_NONE and ctx.check_hostname=False) — enable proper certificate validation to avoid MITM exposure of your API key and data. 2) Inspect and fix the obvious code issues (incomplete identifiers like load_con and _n) and run the scripts in a sandbox to confirm behavior. 3) Keep your V2EX API key private (the skill stores it in a local JSON file in the skill directory). 4) If you plan to let agents invoke the MCP interface automatically, be aware that any agent or integration that can call the MCP tools will be able to use your configured API key; only enable MCP/stdio for trusted agents. If you want, I can point to the exact lines that disable SSL verification and suggest secure replacements.

Type: OpenClaw Skill Name: v2ex-monitor Version: 1.0.0 The V2EX Monitor skill bundle contains a significant security vulnerability where SSL certificate verification is explicitly disabled in both `v2ex_mcp.py` and `v2ex_monitor.py` (`ssl.CERT_NONE`). This high-risk behavior exposes users to Man-in-the-Middle (MITM) attacks when communicating with the V2EX API. While the code's logic aligns with its stated purpose of forum monitoring and lacks clear evidence of intentional malice or data exfiltration to third-party domains, the deliberate bypass of standard security protocols warrants a suspicious classification.