← 返回 Skills 市场

Anne Library Downloader

Name: Anne Library Downloader
Author: neckr0ik

作者 Neckr0ik · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

127

总下载

当前安装

版本数

在 OpenClaw 中安装

/install anne-library-downloader

功能描述

Automates downloading academic PDFs by title, author, DOI, or URL from libraries like ProQuest and EBSCO with auto-login and batch support.

使用说明 (SKILL.md)

Anne's Library Downloader

Download books, articles, and DOIs from academic libraries with full automation.

What This Skill Does

Downloads PDFs from library databases
Extracts DOIs from URLs
Automates authentication for institutional access
Handles VitalSource, ProQuest, EBSCO, and other academic platforms

Installation

# Install dependencies
pip install playwright requests beautifulsoup4

# Install browser for Playwright
playwright install chromium

Usage

# Download a book by title/author
anne-download --book "Essential Biological Psychology" --author "Martin, G. Neil"

# Download by DOI
anne-download --doi "10.1037/0000092-000"

# Download by URL
anne-download --url "https://library.capella.edu/..."

# Batch download from list
anne-download --list ~/Downloads/my_reading_list.txt

Configuration

Set up library credentials:

# For Capella library
export ANNE_LIBRARY_URL="https://capella.alma.exlibrisgroup.com"
export ANNE_LIBRARY_USER="your_username"
export ANNE_LIBRARY_PASS="your_password"

Supported Platforms

VitalSource Bookshelf
ProQuest
EBSCOhost
JSTOR
PubMed Central
ScienceDirect
Springer Link
Taylor & Francis Online

Features

Auto-authentication: Handles institutional login automatically
DOI extraction: Pulls DOI from any academic URL
Metadata preservation: Saves citation info alongside PDF
Batch processing: Download entire reading lists
Format conversion: Convert to PDF, EPUB, or text

Files

scripts/download.py — Main download script
scripts/auth.py — Authentication handlers
scripts/doi_extractor.py — DOI extraction
references/config.json — Library configurations

Skill created: March 8, 2026

安全使用建议

This package is inconsistent and incomplete. It promises automated authenticated downloads and lists multiple helper scripts, but only contains a single Python script that mainly looks up DOIs and prints manual instructions. Do NOT export or store your library username/password for this skill until you verify the missing files and confirm where credentials are used. Specific red flags: 1) SKILL.md asks you to install Playwright and browsers but the code executes a Node Playwright script — Node/NPM requirements are not documented; 2) referenced files (scripts/auth.py, scripts/doi_extractor.py, references/config.json) are missing; 3) the code spawns a temporary JS file and runs it with node (subprocess), which will execute arbitrary code if the JS content or invocation is changed. Before installing or running: ask the author for the missing scripts or a canonical source repository, review the full implementation to confirm how credentials are used and stored, avoid exporting credentials system-wide (use per-command prompts or a secure secret store), and prefer tools from verifiable sources. If you need automated institutional downloads, consider vetted, actively maintained tools with transparent code and clear credential handling.

功能分析

Type: OpenClaw Skill Name: anne-library-downloader Version: 1.0.0 The skill contains a significant security vulnerability in `scripts/download.py` where the `url` parameter is unsafely interpolated into a Playwright JavaScript string, which could lead to arbitrary code execution if the function were active. Additionally, the `SKILL.md` documentation encourages users to store sensitive institutional credentials in environment variables (`ANNE_LIBRARY_PASS`), and the bundle is incomplete, referencing scripts like `scripts/auth.py` and `scripts/doi_extractor.py` that are not provided.

能力评估

⚠ Purpose & Capability

The SKILL.md claims full automation, auto-authentication, platform-specific handlers (auth.py, doi_extractor.py, references/config.json), and batch downloads for many providers. The bundle only contains a single scripts/download.py which mostly performs DOI lookups via Crossref, prints suggested sources, and returns 'requires_manual_download'. Several claimed files (scripts/auth.py, scripts/doi_extractor.py, references/config.json) are referenced but not present. The code does minimal platform handling (simple URL pattern matching) and does not implement the core advertised features (automated authenticated downloads).

⚠ Instruction Scope

SKILL.md instructs users to export library credentials (ANNE_LIBRARY_URL, ANNE_LIBRARY_USER, ANNE_LIBRARY_PASS) and to install Playwright and browsers. The provided Python script does not read those environment variables or implement authentication; instead it writes a temporary JavaScript Playwright script and invokes 'node' to run it. Instructions ask for credentials and imply automatic login, but the shipped code neither consumes those credentials nor performs the promised auth flows — this is scope creep and an unexplained request for secrets.

⚠ Install Mechanism

There is no formal install spec in the package. SKILL.md tells users to run 'pip install playwright requests beautifulsoup4' and 'playwright install chromium', but the Python code generates and executes a Node.js Playwright script via subprocess.run(['node', temp_path]). claw.json lists Python dependencies only; there is no mention of Node or npm dependencies. This mismatch (Python install instructions vs. Node runtime usage) is inconsistent and could lead users to install the wrong runtime or run unexpected binaries. Writing and executing a temporary JS file that is run with node is a potentially risky execution pattern if provenance isn't clear.

⚠ Credentials

The SKILL.md asks for library credentials (username/password, library URL) but the skill metadata declares no required environment variables. The only code present does not read these env vars, so asking users to export secrets is unjustified by the shipped implementation. Requesting institutional credentials would be proportionate if the code actually used them, but here the request is undeclared and unused — raising the risk of unnecessary credential exposure if users follow the instructions.

✓ Persistence & Privilege

The skill does not request elevated persistence: always is false, it's user-invocable, and there is no evidence it modifies other skill or system configurations. No install spec writes files permanently beyond any user-run installs (which are outside the package).

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install anne-library-downloader
安装完成后，直接呼叫该 Skill 的名称或使用 /anne-library-downloader 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of Anne’s Library Downloader: - Automates download of books, articles, and DOIs from major academic libraries. - Supports authentication for institutional access. - Handles platforms including VitalSource, ProQuest, EBSCO, JSTOR, and more. - Extracts DOIs from URLs and preserves citation metadata. - Batch download and format conversion (PDF, EPUB, text) supported.

元数据

Slug anne-library-downloader

版本 1.0.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 1

常见问题